www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Submission: On June 09 via api (June 9th 2020, 11:53:52 pm UTC) from US

Summary HTTP 97 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 43 IPs in 9 countries across 41 domains to perform 97 HTTP transactions. The main IP is 2606:4700:300b::a29f:f77d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.fireeye.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 11th 2019. Valid for: 10 months.

This is the only time www.fireeye.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	2606:4700:300... 2606:4700:300b::a29f:f77d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	23.37.59.76 23.37.59.76	16625 (AKAMAI-AS) (AKAMAI-AS)
2	13.108.250.135 13.108.250.135	14340 (SALESFORCE) (SALESFORCE)
6	104.17.71.206 104.17.71.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:81b::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6810:262f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 4	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE)
1 2	216.58.205.230 216.58.205.230	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f05... 2a03:2880:f058:f:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	184.30.221.218 184.30.221.218	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.85.121.13 52.85.121.13	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3033::ac43:94cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.221.90 185.33.221.90	29990 (ASN-APPNEX) (ASN-APPNEX)
1	13.225.87.59 13.225.87.59	16509 (AMAZON-02) (AMAZON-02)
1	13.225.87.105 13.225.87.105	16509 (AMAZON-02) (AMAZON-02)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
2 3	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:821::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:21f... 2600:9000:21f3:ca00:1a:2af:6d00:93a1	16509 (AMAZON-02) (AMAZON-02)
3	3.232.27.189 3.232.27.189	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
1	54.164.226.178 54.164.226.178	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f15... 2a03:2880:f158:82:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	104.111.229.31 104.111.229.31	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.16.156.50 52.16.156.50	16509 (AMAZON-02) (AMAZON-02)
1	52.57.146.39 52.57.146.39	16509 (AMAZON-02) (AMAZON-02)
2	34.236.162.82 34.236.162.82	14618 (AMAZON-AES) (AMAZON-AES)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	182.22.31.252 182.22.31.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	192.28.147.68 192.28.147.68	53580 (MARKETO) (MARKETO)
1	13.110.70.53 13.110.70.53	14340 (SALESFORCE) (SALESFORCE)
1	182.22.30.220 182.22.30.220	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
1	52.19.133.54 52.19.133.54	16509 (AMAZON-02) (AMAZON-02)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
97	43

30 2606:4700:300b::a29f:f77d (United States)

ASN13335 (CLOUDFLARENET, US)

www.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.37.59.76 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.108.250.135 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl6-ord.la1-c2-ord.salesforceliveagent.com

c.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.la2c2.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.71.206 (United States)

ASN13335 (CLOUDFLARENET, US)

www2.fireeye.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:262f (United States)

ASN13335 (CLOUDFLARENET, US)

js.maxmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:28c::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:809::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f66.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.205.230 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f6.1e100.net

8443343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f058:f:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.221.218 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.121.13 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-121-13.bud50.r.cloudfront.net

app.cdn.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:94cb (United States)

ASN13335 (CLOUDFLARENET, US)

v2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.90 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 727.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.59 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-59.fra2.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.87.105 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-105.fra2.r.cloudfront.net

lftracker.leadfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:ca00:1a:2af:6d00:93a1 (United States)

ASN16509 (AMAZON-02, US)

tr.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.232.27.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-27-189.compute-1.amazonaws.com

abm2.listenloop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.164.226.178 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-226-178.compute-1.amazonaws.com

jukebox.pathfactory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f158:82:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.229.31 (Netherlands)

ASN16625 (AKAMAI-AS, US)

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.16.156.50 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-156-50.eu-west-1.compute.amazonaws.com

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.146.39 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.236.162.82 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-236-162-82.compute-1.amazonaws.com

jukebox.lookbookhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.31.252 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN53580 (MARKETO, US)

848-did-242.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.70.53 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl7-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

d.la1-c1-ia5.salesforceliveagent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.30.220 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.133.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-133-54.eu-west-1.compute.amazonaws.com

fireeye.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	fireeye.com www.fireeye.com www2.fireeye.com	2 MB
5	doubleclick.net 3 redirects 8443343.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	3 KB
4	listenloop.com v2.listenloop.com abm2.listenloop.com	60 KB
4	google-analytics.com 2 redirects www.google-analytics.com	19 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	google.de www.google.de	794 B
3	google.com 2 redirects www.google.com	633 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	lookbookhq.com app.cdn.lookbookhq.com jukebox.lookbookhq.com	197 KB
3	salesforceliveagent.com c.la2c2.salesforceliveagent.com d.la2c2.salesforceliveagent.com d.la1-c1-ia5.salesforceliveagent.com	42 KB
2	yimg.com s.yimg.com	6 KB
2	bidr.io 1 redirects segment.prod.bidr.io	1 KB
2	facebook.com www.facebook.com	442 B
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	marketo.net munchkin.marketo.net	6 KB
2	facebook.net connect.facebook.net	161 KB
2	bing.com bat.bing.com	8 KB
2	maxmind.com js.maxmind.com	2 KB
1	yahoo.com sp.analytics.yahoo.com	530 B
1	omtrdc.net fireeye.tt.omtrdc.net	2 KB
1	yahoo.co.jp b91.yahoo.co.jp	909 B
1	mktoresp.com 848-did-242.mktoresp.com	304 B
1	yimg.jp s.yimg.jp	2 KB
1	addthisedge.com v1.addthisedge.com	958 B
1	twitter.com analytics.twitter.com	651 B
1	moatads.com z.moatads.com	1 KB
1	6sense.com epsilon.6sense.com	579 B
1	pathfactory.com jukebox.pathfactory.com	3 KB
1	googleapis.com fonts.googleapis.com	759 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	7 KB
1	lfeeder.com tr.lfeeder.com	291 B
1	t.co t.co	448 B
1	leadfeeder.com lftracker.leadfeeder.com	4 KB
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googletagmanager.com www.googletagmanager.com	86 KB
1	typography.com 1 redirects cloud.typography.com	456 B
97	41

	Domain	Requested by
30	www.fireeye.com	www.fireeye.com app.cdn.lookbookhq.com
6	www2.fireeye.com	www.fireeye.com www2.fireeye.com
4	www.google-analytics.com	2 redirects www.googletagmanager.com
3	abm2.listenloop.com	www.fireeye.com
3	www.google.de	www.fireeye.com
3	www.google.com	2 redirects www.fireeye.com
3	s7.addthis.com	www.fireeye.com s7.addthis.com
2	s.yimg.com	www.fireeye.com
2	jukebox.lookbookhq.com	www.fireeye.com
2	segment.prod.bidr.io	1 redirects www.fireeye.com
2	www.facebook.com	www.fireeye.com connect.facebook.net
2	stats.g.doubleclick.net	2 redirects
2	px.ads.linkedin.com	1 redirects www.fireeye.com
2	secure.adnxs.com	2 redirects
2	munchkin.marketo.net	www.googletagmanager.com munchkin.marketo.net
2	connect.facebook.net	www.fireeye.com connect.facebook.net
2	8443343.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	bat.bing.com	www.googletagmanager.com www.fireeye.com
2	js.maxmind.com	www.fireeye.com
1	sp.analytics.yahoo.com	www.fireeye.com
1	fireeye.tt.omtrdc.net	www.fireeye.com
1	b91.yahoo.co.jp	www.fireeye.com
1	d.la1-c1-ia5.salesforceliveagent.com	www.fireeye.com
1	848-did-242.mktoresp.com	www.fireeye.com
1	s.yimg.jp	www.googletagmanager.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	d.la2c2.salesforceliveagent.com	www.fireeye.com
1	analytics.twitter.com	www.fireeye.com
1	z.moatads.com	s7.addthis.com
1	epsilon.6sense.com	www.fireeye.com
1	b.6sc.co	www.fireeye.com
1	c.6sc.co	www.fireeye.com
1	j.6sc.co	www.fireeye.com
1	jukebox.pathfactory.com	www.fireeye.com
1	fonts.googleapis.com	www.fireeye.com
1	maxcdn.bootstrapcdn.com	www.fireeye.com
1	tr.lfeeder.com	www.fireeye.com
1	googleads.g.doubleclick.net	www.fireeye.com
1	t.co	www.fireeye.com
1	www.linkedin.com	1 redirects
1	lftracker.leadfeeder.com	www.fireeye.com
1	attr.ml-api.io	www.fireeye.com
1	s.ml-attr.com	1 redirects
1	v2.listenloop.com	www.fireeye.com
1	app.cdn.lookbookhq.com	www.fireeye.com
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.googletagmanager.com	www.fireeye.com
1	c.la2c2.salesforceliveagent.com	www.fireeye.com
1	cloud.typography.com	1 redirects
97	52

This site contains links to these domains. Also see Links.

Domain
fireeyecommunity.force.com
docs.fireeye.com
partners.fireeye.com
training.fireeye.com
www2.fireeye.com
vision.fireeye.com
fireeye.market
investors.fireeye.com
portal.msrc.microsoft.com
download.microsoft.com
artemonsecurity.blogspot.com
csportal.fireeye.com
community.fireeye.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
itunes.apple.com
www.fireeye.fr
www.fireeye.de
www.fireeye.jp
www.fireeye.kr
www.addthis.com

Subject Issuer	Validity	Valid
fireeye.com CloudFlare Inc ECC CA-2	`2019-12-11` - `2020-10-09`	10 months	crt.sh
la1-c2-ord.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-07-30`	2 years	crt.sh
www2.fireeye.com CloudFlare Inc ECC CA-2	`2020-03-06` - `2020-10-09`	7 months	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.maxmind.com COMODO RSA Organization Validation Secure Server CA	`2018-10-15` - `2020-11-06`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-05-14` - `2020-08-05`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
cdn.lookbookhq.com Amazon	`2019-12-06` - `2021-01-06`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-04` - `2020-10-09`	8 months	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
*.leadfeeder.com Amazon	`2020-03-13` - `2021-04-13`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-04` - `2020-09-04`	6 months	crt.sh
www.google.de GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-05-26` - `2020-08-18`	3 months	crt.sh
*.lfeeder.com Amazon	`2019-10-02` - `2020-11-02`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh
*.listenloop.com RapidSSL RSA CA 2018	`2019-06-14` - `2021-06-17`	2 years	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh
*.pathfactory.com Amazon	`2020-04-05` - `2021-05-05`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
*.segment.prod.bidr.io Amazon	`2020-03-26` - `2021-04-26`	a year	crt.sh
*.6sense.com Amazon	`2019-08-16` - `2020-09-16`	a year	crt.sh
*.lookbookhq.com Amazon	`2020-04-28` - `2021-05-28`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-09-24` - `2020-10-23`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
la1-c1-ia5.salesforceliveagent.com DigiCert SHA2 Secure Server CA	`2019-05-14` - `2021-05-13`	2 years	crt.sh
rd.listing.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-08-30` - `2020-09-29`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-19` - `2020-07-03`	a month	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-03-04` - `2020-08-31`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Frame ID: 2590D0523934FB74A46784189106E787
Requests: 100 HTTP requests in this frame

Frame: https://8443343.fls.doubleclick.net/activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html
Frame ID: 83E2A8F401EB4186DB900774548F5647
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 1955CB6AC0FEFEF08D47D32257720CC2
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7121A4C59AA8FE8449619539B4F06B66
Requests: 1 HTTP requests in this frame

Frame: https://www2.fireeye.com/index.php/form/XDFrame
Frame ID: 2943DFDCB1A0ECFA998F177A7CB6C091
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i
script /\/etc.clientlibs\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

97
Requests

98 %
HTTPS

40 %
IPv6

41
Domains

52
Subdomains

43
IPs

9
Countries

2571 kB
Transfer

5571 kB
Size

19
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://fireeyecommunity.force.com/CustomerCommunity/s/support-community
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.fireeye.com/
Title: Documentation Portal

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/directory/
Title: Partner Locator

Search URL Search Domain Scan URL

URL: http://training.fireeye.com/
Title: Partner Education Center

Search URL Search Domain Scan URL

URL: https://www2.fireeye.com/Partner-Request-LP-New.html
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.fireeye.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://vision.fireeye.com/
Title: The Vision – Digital Magazine

Search URL Search Domain Scan URL

URL: https://fireeye.market/
Title: FireEye Market

Search URL Search Domain Scan URL

URL: http://investors.fireeye.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199
Title: here.

Search URL Search Domain Scan URL

URL: http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
Title: WingBird

Search URL Search Domain Scan URL

URL: https://artemonsecurity.blogspot.com/2017/01/wingbird-rootkit-analysis.html
Title: blog post by "Artem"

Search URL Search Domain Scan URL

URL: https://csportal.fireeye.com/secur/login_portal.jsp?orgId=00D3000000063LS&portalId=06030000000pSNE
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://community.fireeye.com/welcome
Title: Communities

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fireeye
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/fireeye
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/FireEye
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/FireEyeInc
Title: YouTube

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/eye-on-security/id1073779629?mt=2
Title: Podcast

Search URL Search Domain Scan URL

URL: https://www.fireeye.fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.fireeye.de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.fireeye.jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.fireeye.kr/
Title: Korean (한국어)

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://cloud.typography.com/6746836/6977592/css/fonts.css HTTP 302
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Request Chain 35

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html HTTP 302
https://8443343.fls.doubleclick.net/activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html

Request Chain 40

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=fireeye.com&pId=2559013045392867138

Request Chain 42

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252F2017%252F04%252Fcve-2017-0199-hta-handler.html%26time%3D1591746796839%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839&liSync=true

Request Chain 43

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1357683803&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=581983270&gjid=975386513&cid=304520131.1591746797&tid=UA-363943-1&_gid=1870000190.1591746797&_r=1&gtm=2wg5r0MVGC8KK&cd39=304520131.1591746797&z=1505513373 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_gid=1870000190.1591746797&gjid=975386513&_v=j82&z=1505513373 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373&slf_rd=1&random=2087815771

Request Chain 66

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Request Chain 92

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1357683803&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Page%20views%20with%20form&ea=view&el=Form&_u=aHhAAEAB~&jid=1115309685&gjid=236691803&cid=304520131.1591746797&tid=UA-363943-1&_gid=1638235912.1591746799&_r=1&gtm=2wg5r0MVGC8KK&cd3=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&cd17=Form&cd18=3353&cd19=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&z=1113544867 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_gid=1638235912.1591746799&gjid=236691803&_v=j82&z=1113544867 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867&slf_rd=1&random=2278366460

97 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request cve-2017-0199-hta-handler.html Show response
www.fireeye.com/blog/threat-research/2017/04/ 82 KB
22 KB 1055ms
1029ms Document
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1fee6d4ba81c4fc4941c791118ccb9df8e515feb7e75edc3defe85ad6ddcc28

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.fireeye.com
:scheme: https
:path: /blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 09 Jun 2020 23:53:15 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=df336a651ece341ca45853225f9c6de651591746794; expires=Thu, 09-Jul-20 23:53:14 GMT; path=/; domain=.fireeye.com; HttpOnly; SameSite=Lax; Secure
cf-ray: 5a0ec55baaad97de-FRA
cache-control: no-cache="set-cookie"
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding,User-Agent
cf-cache-status: EXPIRED
cf-request-id: 033d19ad47000097decca35200000001
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff nosniff
x-dispatcher: dispatcher2uswest1
x-frame-options: ALLOW-FROM https://content.fireeye.com
x-vhost: publish
x-xss-protection: 1; mode=block
server: cloudflare
content-encoding: gzip

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 111 KB
38 KB 813ms
809ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 38305
cf-request-id: 033d19b157000097decca45200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1baa2-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cd797de-FRA

GET
H2 200 csrf.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/ 4 KB
2 KB 654ms
649ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1676
cf-request-id: 033d19b157000097decca46200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f3e-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cd897de-FRA

GET
H2 200 clientlibs_nav.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 12 KB
4 KB 665ms
661ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_nav.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3882
cf-request-id: 033d19b157000097decca47200000001
last-modified: Fri, 24 Apr 2020 04:08:24 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "2f77-5a401843bfe00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cd997de-FRA

GET
H2

200

3982EDB9831683D51.css
www.fireeye.com/content/dam/fireeye-www/fw/f/775489/
Redirect Chain

https://cloud.typography.com/6746836/6977592/css/fonts.css
https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

293 KB
219 KB

27ms
26ms

Stylesheet
text/css

2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7532
cf-polished: origSize=301416
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 033d19b6e1000097decca6e200000001
last-modified: Wed, 01 Apr 2020 20:06:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"49968-5a240379a0280-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a0ec56b082a97de-FRA
cf-bgj: minify

Redirect headers

Date: Tue, 09 Jun 2020 23:53:17 GMT
Last-Modified: Wed, 01 Apr 2020 20:12:09 GMT
Server: AkamaiNetStorage
ETag: "d0795af83d79e23ccaffb60b4a75e364:1585771928"
Content-Type: text/html
Location: https://www.fireeye.com/content/dam/fireeye-www/fw/f/775489/3982EDB9831683D51.css
Cache-Control: must-revalidate, private
Connection: keep-alive
X-HCo-pid: 14
Content-Length: 154
Expires: Tue, 09 June 2020 23:53:16 GMT

GET
H2 200 patch.css
www.fireeye.com/content/dam/fireeye-www/fw/css/ 360 B
381 B 33ms
29ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/css/patch.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a681cca9fc0504acacb6157248b780c9cbaff015575f4d30f5ab0756329ebeb

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 19581
cf-polished: origSize=559
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
cf-request-id: 033d19b157000097decca42200000001
last-modified: Fri, 05 Jul 2019 19:55:15 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: W/"22f-58cf47916cec0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a0ec5622cd397de-FRA
cf-bgj: minify

GET
H2 200 clientlibs_fw-2019.min.css
www.fireeye.com/etc/designs/fireeye-www/ 210 KB
40 KB 28ms
24ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 21164
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 41247
cf-request-id: 033d19b157000097decca43200000001
last-modified: Fri, 29 May 2020 04:36:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3467b-5a6c1fe020f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cd497de-FRA

GET
H2 200 clientlibs_base.min.css
www.fireeye.com/etc/clientlibs/fireeye-blog/ 5 KB
2 KB 27ms
23ms Stylesheet
text/css 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientlibs/fireeye-blog/clientlibs_base.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 7013
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1501
cf-request-id: 033d19b157000097decca44200000001
last-modified: Fri, 04 Oct 2019 05:18:41 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1507-5940ed5cd2e40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cd697de-FRA

GET
H2 200 utils.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/ 10 KB
4 KB 666ms
663ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/utils.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 3706
cf-request-id: 033d19b158000097decca48200000001
last-modified: Fri, 26 Jul 2019 09:42:21 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "26ad-58e925bdaf940-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cda97de-FRA

GET
H2 200 granite.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/ 4 KB
2 KB 668ms
665ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 1702
cf-request-id: 033d19b158000097decca49200000001
last-modified: Fri, 26 Jul 2019 09:54:26 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "f90-58e9287119880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cdc97de-FRA

GET
H2 200 jquery.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 16 B
168 B 659ms
657ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/jquery.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 16
cf-request-id: 033d19b158000097decca4a200000001
last-modified: Fri, 26 Jul 2019 09:42:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10-58e925d492f40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cdd97de-FRA

GET
H2 200 shared.min.js Show response
www.fireeye.com/etc.clientlibs/foundation/clientlibs/ 24 KB
7 KB 704ms
701ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/foundation/clientlibs/shared.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 6920
cf-request-id: 033d19b158000097decca4b200000001
last-modified: Fri, 26 Jul 2019 09:54:49 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "5e7e-58e9288708c40-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cde97de-FRA

GET
H2 200 modern.min.js Show response
www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/ 34 KB
12 KB 665ms
662ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/clientlibs/granite/lodash/modern.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 11784
cf-request-id: 033d19b158000097decca4c200000001
last-modified: Tue, 17 Oct 2017 06:49:31 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "87c8-55bb8866db4c0-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622cdf97de-FRA

GET
H2 200 kernel.min.js Show response
www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/ 119 KB
26 KB 816ms
814ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc.clientlibs/cq/personalization/clientlib/personalization/kernel.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 26194
cf-request-id: 033d19b158000097decca4d200000001
last-modified: Fri, 26 Jul 2019 09:54:50 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "1dd96-58e92887fce80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5622ce097de-FRA

GET
H/1.1 200
OK deployment.js Show response
c.la2c2.salesforceliveagent.com/content/g/js/34.0/ 40 KB
41 KB 783ms
112ms Script
application/javascript 13.108.250.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL: https://c.la2c2.salesforceliveagent.com/content/g/js/34.0/deployment.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.108.250.135 , United States, ASN14340 (SALESFORCE, US),
Reverse DNS: dcl6-ord.la1-c2-ord.salesforceliveagent.com
Software: Jetty(9.4.z-SNAPSHOT) /
Resource Hash: 3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:16 GMT
Cache-Control: max-age=60, must-revalidate
Last-Modified: Fri, 15 May 2020 16:22:02 GMT
Server: Jetty(9.4.z-SNAPSHOT)
Accept-Ranges: bytes
Content-Length: 41338
Content-Type: application/javascript

GET
H2 200 fireeye-2-color.png
www.fireeye.com/content/dam/fireeye-www/fw/images/ 2 KB
2 KB 694ms
685ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/images/fireeye-2-color.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48dca69d4a48f11abaa7e1a0d846cb4484c0c4fe7ca90552fa7483b1e53ab74b

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=3668
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 2250
cf-request-id: 033d19b4a5000097decca5a200000001
last-modified: Mon, 25 Feb 2019 20:12:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "e54-582bd904dc940"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ebe97de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 10 KB
11 KB 674ms
666ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

110a7cc091a04f8daa03248a7d0d3da1d8a24afc919aedd82ae884ddf49ac6ba

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=16945
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 10749
cf-request-id: 033d19b4a5000097decca5b200000001
last-modified: Tue, 11 Apr 2017 16:17:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "4231-54ce66e85ba00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ebf97de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 9 KB
9 KB 710ms
702ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

88ffa93972fd10cb77f72406f1fa886a814dec52adb5f86c151f23fa2da55a4a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=20746
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 8736
cf-request-id: 033d19b4a5000097decca5c200000001
last-modified: Tue, 11 Apr 2017 16:17:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "510a-54ce66e94fc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec197de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig3.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 10 KB
10 KB 703ms
695ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig3.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

402d6993a8d8e50da41d6f5e34d7206e4b61ba74599617c7ea4c513afdf5b1c8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=15875
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 10151
cf-request-id: 033d19b4a5000097decca5d200000001
last-modified: Tue, 11 Apr 2017 16:17:45 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3e03-54ce66e94fc40"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec397de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig4.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 174 KB
175 KB 671ms
663ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig4.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94a4bb6bd947da2837eeab294d95484a94edc8ffbd0693378a5d24e920979c31

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=249851
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 178164
cf-request-id: 033d19b4a5000097decca5e200000001
last-modified: Tue, 11 Apr 2017 16:17:46 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "3cffb-54ce66ea43e80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec597de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig5.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 48 KB
48 KB 690ms
682ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig5.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82755a4b4ba68c6b1fa4b548071ec6570f5bb3ed089bb699a8646a3c5e8991e8

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=66407
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 48686
cf-request-id: 033d19b4a5000097decca5f200000001
last-modified: Tue, 11 Apr 2017 16:17:47 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "10367-54ce66eb380c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec697de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Code1.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 5 KB
6 KB 711ms
703ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Code1.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bf2a2b56626880433a43cb7937e23adecb2bd80821052bd534247c5f10bff62

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=8915
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 5516
cf-request-id: 033d19b4a5000097decca60200000001
last-modified: Tue, 11 Apr 2017 16:17:43 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "22d3-54ce66e7677c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec897de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Code2.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 15 KB
15 KB 710ms
702ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Code2.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ad14083a44381b16ac11c3d013c61ef822cefd107da423fafeb476e77c0402a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=28476
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 15486
cf-request-id: 033d19b4a5000097decca61200000001
last-modified: Tue, 11 Apr 2017 16:17:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "6f3c-54ce66e85ba00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ec997de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Fig6.png
www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/ 186 KB
187 KB 666ms
659ms Image
image/png 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/MSFT%200day/Fig6.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a651134a4ed674e6fd28722d2576ce19bf8e0699e5b388c3eb9f8d485bbfcfe5

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=266792
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 190758
cf-request-id: 033d19b4a8000097decca62200000001
last-modified: Tue, 11 Apr 2017 16:17:47 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "41228-54ce66eb380c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5677ecb97de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 blog-vision-edition7.gif
www.fireeye.com/content/dam/fireeye-www/blog/images/ 570 KB
571 KB 693ms
686ms Image
image/gif 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fireeye.com/content/dam/fireeye-www/blog/images/blog-vision-edition7.gif

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origSize=592867
x-vhost: publish
status: 200
vary: Accept-Encoding
content-length: 584046
cf-request-id: 033d19b4a8000097decca63200000001
last-modified: Thu, 04 Jun 2020 22:12:02 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "90be3-5a7496f1a5080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5677ecc97de-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ 203 KB
68 KB 259ms
29ms Script
application/x-javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1063
status: 200
cf-request-id: 033d19b5870000c83f6fb7e200000001
last-modified: Sat, 06 Jun 2020 07:41:48 GMT
server: cloudflare
etag: "2419c6-32dcc-5a76582a4d00c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5a0ec568dd92c83f-AMS
expires: Wed, 10 Jun 2020 03:53:16 GMT

GET
H2 200 clientlibs_fw.min.js Show response
www.fireeye.com/etc/designs/fireeye-www/ 164 KB
50 KB 1158ms
1149ms Script
application/javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw.min.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b7b2f7b99ef95b2f4fbd89f372e734216c11d8467af0e795f354937b461e21

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: EXPIRED
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 50472
cf-request-id: 033d19b4a5000097decca59200000001
last-modified: Fri, 29 May 2020 04:36:44 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "28e57-5a6c1fe020f00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec5676ebd97de-FRA

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 85ms
26ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.15.8 /

Resource Hash

079c30478215da1e544443314dabb6ab1251fa2ae56447ace992ade3bbe3fd0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 02 Jun 2020 20:09:59 GMT
server: nginx/1.15.8
etag: W/"5ed6b217-582c2"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Tue, 09 Jun 2020 23:53:16 GMT
x-host: s7.addthis.com
content-length: 116281

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 280 KB
86 KB 57ms
29ms Script
application/javascript 2a00:1450:4001:81b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

43f29aa55ae9e0fa1776400cf941f586d26f69ae26061290cf97bc90c30afa4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87303
x-xss-protection: 0
last-modified: Tue, 09 Jun 2020 23:18:38 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 09 Jun 2020 23:53:16 GMT

GET
H2 200 token.json Show response
www.fireeye.com/libs/granite/csrf/ 2 B
476 B 674ms
673ms XHR
application/json 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/libs/granite/csrf/token.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 2
cf-request-id: 033d19b499000097decca57200000001
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json;charset=iso-8859-1
x-xss-protection: 1; mode=block
cache-control: no-cache, no-cache="set-cookie"
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-ray: 5a0ec5675eb497de-FRA
expires: -1

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
1 KB 101ms
66ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b6b811536ee539109f82adae5b42aeb30972076c3f00189f87015121c862dc7

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5a0ec5679f70645b-FRA
content-length: 771
cf-request-id: 033d19b4be0000645b7cb3b200000001

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 35ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=29597
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 bat.js Show response
bat.bing.com/ 25 KB
8 KB 58ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 78a81c2a32cbd6675976ff2074623000dafc3e80bf6698801b9e369c0656a89c

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:15 GMT
content-encoding: gzip
last-modified: Wed, 13 May 2020 20:59:59 GMT
x-msedge-ref: Ref A: E57D08D50DE247ACAEA632A989B09203 Ref B: FRAEDGE1319 Ref C: 2020-06-09T23:53:16Z
status: 200
etag: "80b179766929d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7767

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 31ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 30 Apr 2020 21:54:13 GMT
server: Golfe2
age: 4418
date: Tue, 09 Jun 2020 22:39:38 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18433
expires: Wed, 10 Jun 2020 00:39:38 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 66ms
22ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
age: 8498
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-hhn4023-HHN
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1591746797.860969,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 28 KB
12 KB 88ms
33ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

cd34ee8ae406b1662e7ef53583b899f9ccc52d0920127c4716c6944a68916cd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 10884
x-xss-protection: 0
server: cafe
etag: 10406653800972162523
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 09 Jun 2020 23:53:16 GMT

GET
H2

200

activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F...
8443343.fls.doubleclick.net/ Frame 83E2
Redirect Chain

https://8443343.fls.doubleclick.net/activityi;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%...
https://8443343.fls.doubleclick.net/activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fir...

0
0

35ms
32ms

Document
text/html

216.58.205.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8443343.fls.doubleclick.net/activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8443343.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 09 Jun 2020 23:53:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 483
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 10-Jun-2020 00:08:16 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Tue, 09 Jun 2020 23:53:16 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8443343.fls.doubleclick.net/activityi;dc_pre=CLr4l_P29ekCFVWKdwodYRoO-g;src=8443343;type=sitew0;cat=firee0;ord=9706221446404;gtm=2wg5r0;auiddc=1592496767.1591746797;u1=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html;u2=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc;~oref=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 131 KB
32 KB 74ms
21ms Script
application/x-javascript 2a03:2880:f058:f:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f058:f:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 31766
x-xss-protection: 0
pragma: public
x-fb-debug: Z2KpYrj2I31hFPzOdmKUVtu4ifAh3KEVrX4rcCrc4xHCEamiSBgMLnlAdEOcKRBLj2r22bvs+LdRpYifNmknvg==
x-fb-trip-id: 1679558926
x-frame-options: DENY
date: Tue, 09 Jun 2020 23:53:16 GMT, Tue, 09 Jun 2020 23:53:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 78ms
22ms Script
application/x-javascript 184.30.221.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.221.218 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Apache /
Resource Hash: c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 03 Apr 2020 02:45:45 GMT
Server: Apache
ETag: "aa520b8aca3502dbdbf62462e6f4be67:1585881945"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 751

GET
H2 200 jukebox.js Show response
app.cdn.lookbookhq.com/production/jukebox/current/ 806 KB
196 KB 206ms
66ms Script
text/javascript 52.85.121.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cdn.lookbookhq.com/production/jukebox/current/jukebox.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.85.121.13 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-121-13.bud50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7b31177a5f3a934fd7d86abd3a7c9c0100dc1f299bdce1cddfc946b2c42b4e3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 27 May 2020 19:59:24 GMT
server: AmazonS3
age: 36454
date: Tue, 09 Jun 2020 13:45:43 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
cache-control: max-age=43200
x-amz-cf-pop: BUD50-C1
x-amz-cf-id: 8Amyvv2WkF24E51K4fJ5DF9BmnTbnBAp5qneKAi3eBSGlldAcDV1nA==
via: 1.1 384ab54f8262fdb1520bb443b42f25e3.cloudfront.net (CloudFront)

GET
H2 200 loop.bundle.js Show response
v2.listenloop.com/ 175 KB
57 KB 72ms
18ms Script
application/javascript 2606:4700:3033::ac43:94cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v2.listenloop.com/loop.bundle.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:94cb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e10cbbf23a20b5282287e1cec45fae4af6af4097d2e4cf5154605cc9e8d91d3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: br
cf-cache-status: HIT
age: 1316
status: 200
x-amz-request-id: 92FE7EFDBB639287
x-amz-id-2: awTizHR7dcVprprKYHr9LbWfchqSyJB7wH86adBO3tgmkAfkineTgdBxBDxP63or55XLX8qeoUI=
last-modified: Thu, 04 Jun 2020 11:18:13 GMT
server: cloudflare
etag: W/"c76108a13adf714a466d5c758ea5a717"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1800
cf-request-id: 033d19b55600000746d9259200000001
cf-ray: 5a0ec5688c3e0746-FRA

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dfireeye.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dfireeye.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=fireeye.com&pId=2559013045392867138

4 B
484 B

443ms
348ms

Image
image/jpeg

13.225.87.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=fireeye.com&pId=2559013045392867138
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.87.59 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-59.fra2.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:17 GMT
Via: 1.1 2fcedcc055e24d7ac99fbc19ed8fc8ec.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C2
x-amzn-RequestId: 01498034-5a12-4686-8e77-4f57230af7c2
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5ee020ed-a6a4387e038ef1eae7eb87e9;Sampled=0
Connection: keep-alive
x-amz-apigw-id: N4oVKG4vIAMF-tQ=
Content-Length: 4
X-Amz-Cf-Id: CiArmxZZok3TfqOBqrChhAGoyRum00AFNZXJC1QuyO6JOsrLWpWwag==

Redirect headers

Pragma: no-cache
Date: Tue, 09 Jun 2020 23:53:19 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 727.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.52:80
AN-X-Request-Uuid: 87a7abd3-e549-4d8b-864d-db877269ca66
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=fireeye.com&pId=2559013045392867138
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 lftracker_v1_3P1w24dgrmJ7mY5n.js Show response
lftracker.leadfeeder.com/ 9 KB
4 KB 71ms
27ms Script
application/javascript 13.225.87.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://lftracker.leadfeeder.com/lftracker_v1_3P1w24dgrmJ7mY5n.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.87.105 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-105.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9c450c93603dd9bfa4f7ec95c6149d3e3d2bad386a1fd47db304f1ede945ce95

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 12:04:47 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-id: SxsN5EFjm6oZSCQJlam2riqEzlrdEgA2sPkhzFRJceXEFjpAbq4aiQ==
via: 1.1 d9bf8acc1da383db4531789bbb03ac07.cloudfront.net (CloudFront)

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D6572%26url%3Dhttps%253A%252F%252Fwww.fireeye.com%252Fblog%252Fthreat-research%252...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839&liSync=true

0
81 B

113ms
112ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839&liSync=true
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: Dh5XWEcFFxYwCwtf3CoAAA==

Redirect headers

strict-transport-security: max-age=2592000
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: 8HeSTEcFFxYg309FBCsAAA==
pragma: no-cache
x-li-pop: afd-prod-lva1
x-msedge-ref: Ref A: 0351115B7B00458FBF82F8C1226FBE2A Ref B: FRAEDGE1415 Ref C: 2020-06-09T23:53:17Z
date: Tue, 09 Jun 2020 23:53:16 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6572&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&time=1591746796839&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1357683803&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_gid=1870000190.1591746797&gjid=975386513&_v=j82&z=1505513373
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373&slf_rd=1&random=2087815771

42 B
535 B

40ms
16ms

Image
image/gif

2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373&slf_rd=1&random=2087815771

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:16 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=581983270&_v=j82&z=1505513373&slf_rd=1&random=2087815771
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
148 B 45ms
44ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5870833&Ver=2&mid=3b301cd5-be54-0ee1-afaf-26bf954c221d&sid=eb4a9f42-ae1c-e33d-eb0c-dc13b3ed792b&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&p=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&r=&evt=pageLoad&msclkid=N&sv=1&rn=910842
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 09 Jun 2020 23:53:15 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 51F49747418749B0AE4B567837329C8D Ref B: FRAEDGE1319 Ref C: 2020-06-09T23:53:16Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 195ms
143ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Tue, 09 Jun 2020 23:53:17 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 938f71b53c91e99c7d4f0243b343ad93
x-transaction: 007db17f001be7a9
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/ 2 KB
2 KB 59ms
21ms Script
text/javascript 2a00:1450:4001:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/968899429/?random=1591746796902&cv=9&fst=1591746796902&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5r0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

985463905919b26c7876284079da3e08a41e6abded151f6d0be888bcbc54d2a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-25="googleads.g.doubleclick.net:443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1074
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
tr.lfeeder.com/ 43 B
291 B 50ms
34ms Image
image/gif 2600:9000:21f3:ca00:1a:2af:6d00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.lfeeder.com/?sid=3P1w24dgrmJ7mY5n&data=eyJnYVRyYWNraW5nSWRzIjpbIlVBLTM2Mzk0My0xIl0sImdhQ2xpZW50SWRzIjpbIjMwNDUyMDEzMS4xNTkxNzQ2Nzk3Il0sImNvbnRleHQiOnsibGlicmFyeSI6eyJuYW1lIjoibGZ0cmFja2VyIiwidmVyc2lvbiI6IjEuNC4wIn0sInBhZ2VVcmwiOiJodHRwczovL3d3dy5maXJlZXllLmNvbS9ibG9nL3RocmVhdC1yZXNlYXJjaC8yMDE3LzA0L2N2ZS0yMDE3LTAxOTktaHRhLWhhbmRsZXIuaHRtbCIsInJlZmVycmVyIjoiIiwicGFnZVRpdGxlIjoiQ1ZFLTIwMTctMDE5OTogSW4gdGhlIFdpbGQgQXR0YWNrcyBMZXZlcmFnaW5nIEhUQSBIYW5kbGVyIHwgRmlyZUV5ZSBJbmMifSwiZXZlbnQiOiJ0cmFja2luZy1ldmVudCIsImNsaWVudFRpbWVzdGFtcCI6IjIwMjAtMDYtMDlUMjM6NTM6MTYuOTQ2WiIsImNsaWVudFRpbWV6b25lIjotMTIwLCJzY3JpcHRJZCI6IjNQMXcyNGRncm1KN21ZNW4iLCJjb29raWVzRW5hYmxlZCI6dHJ1ZSwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuYzQ1YzhlY2Q4Y2I5NTA0MC4xNTkxNzQ2Nzk2OTM5IiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fX0=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:ca00:1a:2af:6d00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:16 GMT
via: 1.1 71dbd5706c5b0c7b733248e1171f2d4f.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA2-C2
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
status: 200
content-length: 43
x-amz-cf-id: L4I36a931u7ExN9rQiqnP4u_-lmvUvKhhSrZdQ2B2daexEUoNodaPw==

GET
H2 200 1847206522249226 Show response
connect.facebook.net/signals/config/ 517 KB
129 KB 94ms
93ms Script
application/x-javascript 2a03:2880:f058:f:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1847206522249226?v=2.9.18&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f058:f:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d4eae71ff47319b9bcb824e70dbfbe6da1be9fa875552c57e5fe557587010406

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: SU5xTo4kOsIhvYeqJ8GWuoEyatZRZf9BvWWN/kAH9iFwGfn7xexuT9U/yXQHpHqwg7ocVbrFli3YfC5Udn/9Hw==
x-fb-trip-id: 1679558926
x-frame-options: DENY
date: Tue, 09 Jun 2020 23:53:17 GMT, Tue, 09 Jun 2020 23:53:17 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/968899429/ 42 B
150 B 28ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/968899429/?random=1591746796902&cv=9&fst=1591743600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5r0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=1937430418&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/968899429/ 42 B
153 B 28ms
20ms Image
image/gif 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/968899429/?random=1591746796902&cv=9&fst=1591743600000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg5r0&sendb=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&async=1&fmt=3&is_vtc=1&random=1937430418&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK me Show response
abm2.listenloop.com/api/v1/public/organizations/ 574 B
1 KB 472ms
111ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/organizations/me?public_key=MRxJc5qdz5T-wKxBNsh4
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Runtime: 0.006519
Date: Tue, 09 Jun 2020 23:53:17 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"433357c8643acb3a3193314b88370601"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 361
X-Request-Id: 28360b22-42c0-4f65-bd8d-c0d07fd703b4

POST
H/1.1 200
OK retargeting_segments Show response
abm2.listenloop.com/api/v1/public/ 27 B
760 B 466ms
109ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/retargeting_segments
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0

Request headers

Accept: */*
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

X-Runtime: 0.006028
Date: Tue, 09 Jun 2020 23:53:17 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"08100b3787392183cd0486ef68c96b9f"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 53
X-Request-Id: edb39190-db7b-4737-9943-c54f8e538e10

GET d1d78adf-d5b1-4da8-bed9-ab83df743b7f
https://www.fireeye.com/ 0
0

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 28 KB
7 KB 63ms
14ms Stylesheet
text/css 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:20 GMT
status: 200
etag: "1544639720"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 6591

GET
H2 200 css
fonts.googleapis.com/ 5 KB
759 B 20ms
19ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 09 Jun 2020 23:01:51 GMT
server: ESF
date: Tue, 09 Jun 2020 23:53:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Jun 2020 23:53:17 GMT

GET
H2 200 website_experience Show response
jukebox.pathfactory.com/api/public/v1/ 7 KB
3 KB 264ms
263ms XHR
application/json 54.164.226.178
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.pathfactory.com/api/public/v1/website_experience?clientId=LB-9AC90F09-10427&visitorUuid=undefined&title=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&image=https%3A%2F%2Fwww.fireeye.com%2Fcontent%2Fdam%2Ffireeye-www%2Ffw%2Fimages%2Ffireeye-2-color-square.png

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.164.226.178 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-164-226-178.compute-1.amazonaws.com

Software

Resource Hash

868f9a43f4f56d4aadd7518da30788192afc3f5ba266a35d9d638682120dfdbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.152339
date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"868f9a43f4f56d4aadd7518da3078819"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: da861fd9-5f8a-4ccb-af9c-36aa3a6a5954

GET
H2 200 /
www.facebook.com/tr/ 44 B
359 B 83ms
31ms Image
image/gif 2a03:2880:f158:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1847206522249226&ev=PageView&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&rl=&if=false&ts=1591746797305&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1591746797304.457323651&it=1591746796961&coo=false&rqm=GET

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f158:82:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT, Tue, 09 Jun 2020 23:53:17 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 09 Jun 2020 23:53:17 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 14 KB
7 KB 104ms
30ms Script
application/javascript 104.111.229.31
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 5535d2c567dac9fb9a8eb888a5415164e87c4aa6f08f70a6cc6ab1c0cd3bac12

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:17 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
X-Check-Cacheable: YES
Connection: keep-alive
Content-Length: 6031
Last-Modified: Sun, 12 Apr 2020 02:02:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e9276ac-3997"
X-Serial: 1
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 fireicons.woff
www.fireeye.com/content/dam/fireeye-www/fw/f/ 72 KB
36 KB 55ms
26ms Font
application/x-font-woff 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/content/dam/fireeye-www/fw/f/fireicons.woff?mva1rk

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/etc/designs/fireeye-www/clientlibs_fw-2019.min.css
Origin: https://www.fireeye.com

Response headers

x-dispatcher: dispatcher2uswest1
date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 38159
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 36804
cf-request-id: 033d19b75b000097decca70200000001
last-modified: Tue, 24 Sep 2019 21:47:18 GMT
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-font-woff
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec56bc88897de-FRA

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 getForm Show response
www2.fireeye.com/index.php/form/ 8 KB
2 KB 54ms
54ms Script
application/javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www2.fireeye.com/index.php/form/getForm?munchkinId=848-DID-242&form=3353&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&callback=jQuery112405030395107937902_1591746797664&_=1591746797665
Requested by: Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab59e15d34a0a1beb052fde1b9e029045a2281c2ffa267e7a17d0e2dd8289584

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cf-request-id: 033d19b8910000c83f6fb8f200000001
cf-ray: 5a0ec56dba9ac83f-AMS
cached: true

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

43 B
793 B

34ms
32ms

Image
image/gif

52.16.156.50
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.16.156.50 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-156-50.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 09 Jun 2020 23:53:17 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=listenloop&segment_key=listenloop-11912&value=&_bee_ppp=1
Date: Tue, 09 Jun 2020 23:53:17 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
371 B 94ms
25ms XHR
text/plain 104.111.229.31
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: /
Resource Hash: d9bba1001def66054e4cb1f3880abf4b19483b35891af50e302c19260bbec0b9

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:17 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.fireeye.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 270ms
212ms Image
image/gif 104.111.229.31
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=1322340356018696d853e0ac6f7ce3a2&svisitor=&visitor=47938897-6a70-4abd-85cd-55820a1e300d&session=532e436c-cd98-4ff3-8f96-a3b2af3cb9db&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22FireEye%20recently%20detected%20malicious%20Microsoft%20Office%20RTF%20documents%20that%20leverage%20CVE-2017-0199%2C%20a%20previously%20undisclosed%20vulnerability.%5Cn%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc%22%7D&cb=46797744&r=&thirdParty=%7B%7D

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.229.31 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:18 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
5 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.fireeye.com

Response headers

Content-Type: application/x-font-woff2

POST
H2 200 /
www.facebook.com/tr/ 0
83 B 23ms
22ms Other
text/plain 2a03:2880:f158:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f158:82:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary5VR9dbne2AecEgfH

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Tue, 09 Jun 2020 23:53:17 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 details Show response
epsilon.6sense.com/v1/company/ 604 B
579 B 76ms
29ms XHR
application/json 52.57.146.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.146.39 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-146-39.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 6a822b86cffdec9e6739059198523e360e121ecdfbe43c51703c6626c802f843

Request headers

Authorization: Token 325d6d60e24c7cfc3a782839d85ce08c8d3bb27c
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
EpsilonCookie: 36bb1002ab400000ed20e05ea30100007d510000

Response headers

date: Tue, 09 Jun 2020 23:53:18 GMT
content-encoding: gzip
server: nginx/1.16.0
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.fireeye.com
access-control-allow-credentials: true
content-length: 390

GET
H2 200 forms2.css
www2.fireeye.com/js/forms2/css/ 13 KB
3 KB 25ms
23ms Stylesheet
text/css 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7022
status: 200
vary: Accept-Encoding
content-length: 2610
cf-request-id: 033d19b9380000c83f6fb96200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e0f-33f8-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5a0ec56ecbdfc83f-AMS
expires: Wed, 10 Jun 2020 03:53:17 GMT

GET
H2 200 forms2-theme-simple.css
www2.fireeye.com/js/forms2/css/ 826 B
356 B 27ms
26ms Stylesheet
text/css 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7021
status: 200
vary: Accept-Encoding
content-length: 242
cf-request-id: 033d19b9380000c83f6fb97200000001
last-modified: Wed, 27 May 2020 19:45:35 GMT
server: cloudflare
etag: "201e15-33a-5a6a674a055c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5a0ec56ecbe1c83f-AMS
expires: Wed, 10 Jun 2020 03:53:17 GMT

POST
H2 200 page_views Show response
jukebox.lookbookhq.com/api/public/v1/ 153 B
656 B 186ms
186ms XHR
application/json 34.236.162.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.236.162.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-236-162-82.compute-1.amazonaws.com

Software

Resource Hash

ac6ae3e18713f0af9681e92e3b172a8a421543f4f42153457ce40498a5fbb3fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.077513
date: Tue, 09 Jun 2020 23:53:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
etag: W/"ac6ae3e18713f0af9681e92e3b172a8a"
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin, Accept-Encoding
x-request-id: 5b864f7d-0ce7-4caa-8ae3-90e505abfec4

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 78ms
25ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:18 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=60975
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/158/ 11 KB
5 KB 34ms
33ms Script
application/x-javascript 184.30.221.218
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/158/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.221.218 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Jun 2020 23:53:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 03:01:21 GMT
Server: AkamaiNetStorage
ETag: "67df7eb9e9e68638308f14367dddec10:1580180481"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4686
Expires: Thu, 17 Sep 2020 23:53:18 GMT

GET
H2 200 me Show response
js.maxmind.com/geoip/v2.1/country/ 771 B
979 B 69ms
68ms XHR
application/vnd.maxmind.com-country+json 2606:4700::6810:262f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.maxmind.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.fireeye.com
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:262f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49b21abffd2ad2c12a328ca91ad0fbbb6bfd2e1f57aacf95cc236077c0bac9ff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:18 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/vnd.maxmind.com-country+json; charset=UTF-8; version=2.1
access-control-allow-origin: *
cf-ray: 5a0ec56fa903645b-FRA
content-length: 771
cf-request-id: 033d19b9c70000645b7cb47200000001

GET
H2 200 segmentation.segment.js Show response
www.fireeye.com/etc/ 0
151 B 33ms
21ms XHR
application/x-javascript 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/segmentation.segment.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:18 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: HIT
age: 64639
x-vhost: publish
status: 200
vary: User-Agent, Accept-Encoding
content-length: 0
cf-request-id: 033d19b9d5000097decca87200000001
cf-bgj: minify
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript
x-xss-protection: 1; mode=block
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
accept-ranges: bytes
cf-ray: 5a0ec56fba1b97de-FRA

GET
H2 403 stores.init.js Show response
www.fireeye.com/etc/clientcontext/default/content/jcr:content/ 3 KB
1 KB 11ms
10ms XHR
text/html 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/etc/clientcontext/default/content/jcr:content/stores.init.js?path=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler&_=1591746796692

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df920dd3acb5daee7f0dc0105aacb3d1bc37fcefc0f83da92349fb1d40d573d3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:18 GMT
content-encoding: gzip
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 403
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 5a0ec56fba1d97de-FRA
cf-request-id: 033d19b9d7000097decca88200000001
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 read-blogentries Show response
www.fireeye.com/bin/www-blogs/ 95 KB
17 KB 1054ms
1054ms XHR
text/plain 2606:4700:300b::a29f:f77d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fireeye.com/bin/www-blogs/read-blogentries?categoryPath=%2Fcontent%2Ffireeye-www%2Fen_US%2Fblog%2Fthreat-research

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700:300b::a29f:f77d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51a816d6236c852abc450f36cb5875e0713a1345aa7eeefe5517f84182ab37b2

Security Headers

Name	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-dispatcher: dispatcher1uswest1
date: Tue, 09 Jun 2020 23:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
x-vhost: publish
status: 200
vary: Accept-Encoding,User-Agent
content-length: 16914
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: ALLOW-FROM https://content.fireeye.com
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
cf-request-id: 033d19b9d9000097decca89200000001
cf-ray: 5a0ec56fca1f97de-FRA

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 1955 0
0

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 184ms
132ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw2v7&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 109
pragma: no-cache
last-modified: Tue, 09 Jun 2020 23:53:19 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: a62dc14de4b275b16d6a92d19b9caba4
x-transaction: 00a46cfa0062b729
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la2c2.salesforceliveagent.com/chat/rest/System/ 226 B
592 B 469ms
116ms Script
text/javascript 13.108.250.135
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la2c2.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.108.250.135 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl6-ord.la1-c2-ord.salesforceliveagent.com

Software

Resource Hash

573e3529383c85c696d55c17aecbf20d1fbbdd9c3fe96005d3c00e3dbd024e3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/fewebadmin/ 3 KB
958 B 47ms
44ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/fewebadmin/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: /
Resource Hash: 4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:19 GMT
content-encoding: gzip
etag: 2015823830--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=46, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 782

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 88 B
248 B 207ms
204ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5ee020edac86b040&bkl=0&bl=1&pdt=1069&sid=5ee020edac86b040&pub=fewebadmin&rev=v8.28.6-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fireeye.com&fp=blog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1591746799117&jsl=8193&uvs=5ee020ed70600e04000&skipb=1&callback=addthis.cbs.jsonp__2156558118606160
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: /
Resource Hash: 643c63b7d42c3a8ac70f3de4f817f2a782f16d5442067adafbb63c8af7ea31fb

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Tue, 09 Jun 2020 23:53:19 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 88
content-type: application/javascript;charset=utf-8

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 7121 0
0 30ms
28ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Tue, 09 Jun 2020 23:53:19 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

POST
H2 204 create_event Show response
jukebox.lookbookhq.com/api/public/v1/page_views/ 0
378 B 114ms
113ms XHR
text/plain 34.236.162.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://jukebox.lookbookhq.com/api/public/v1/page_views/create_event

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.236.162.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-236-162-82.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.006956
date: Tue, 09 Jun 2020 23:53:19 GMT
x-content-type-options: nosniff
status: 204
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, PATCH, OPTIONS
access-control-allow-origin: https://www.fireeye.com
access-control-expose-headers
cache-control: no-cache
access-control-allow-credentials: true
vary: Origin
x-request-id: fd69004c-2d13-4f89-9c5e-98ab9654ebce

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 4 KB
2 KB 792ms
262ms Script
application/javascript 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MVGC8KK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 09 Jun 2020 23:48:50 GMT
content-encoding: gzip
last-modified: Thu, 29 Aug 2019 10:27:08 GMT
server: ATS
age: 269
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 1421
via: http/1.1 edge1167.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1174.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Tue, 09 Jun 2020 23:58:50 GMT

POST
H/1.1 200
OK page_views Show response
abm2.listenloop.com/api/v1/public/ 333 B
940 B 928ms
928ms XHR
application/json 3.232.27.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://abm2.listenloop.com/api/v1/public/page_views
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.232.27.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-27-189.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5c5897b5e08c97222ea272f227de1047961dce826ff8c7ef4761937a7528dc8e

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/json

Response headers

X-Runtime: 0.823070
Date: Tue, 09 Jun 2020 23:53:20 GMT
Content-Encoding: gzip
Server: nginx
ETag: W/"9e6fdc9351b65fb15bb0dfe8e66fe9e3"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, OPTIONS, HEAD
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.fireeye.com
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Access-Control-Request-Headers,X-User-Token,X-User-email,content-type,X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset
Content-Length: 232
X-Request-Id: cf01b052-1df7-4860-b9b5-dde5ec39c430

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j82&a=1357683803&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_gid=1638235912.1591746799&gjid=236691803&_v=j82&z=1113544867
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867&slf_rd=1&random=2278366460

42 B
106 B

17ms
16ms

Image
image/gif

2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867&slf_rd=1&random=2278366460

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:19 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-363943-1&cid=304520131.1591746797&jid=1115309685&_v=j82&z=1113544867&slf_rd=1&random=2278366460
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 XDFrame Show response
www2.fireeye.com/index.php/form/ Frame 2943 2 KB
1 KB 183ms
182ms Document
text/html 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/index.php/form/XDFrame

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: www2.fireeye.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: vid=9bc1d6ce-8116-40f1-92fc-8fb844124e6e; _ga=GA1.2.304520131.1591746797; _gid=GA1.2.1638235912.1591746799; _gat_UA-363943-1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Response headers

status: 200
date: Tue, 09 Jun 2020 23:53:19 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=dd4b40b43ef07bf1193d972c0dcf80c1c1591746799; expires=Thu, 09-Jul-20 23:53:19 GMT; path=/; domain=.www2.fireeye.com; HttpOnly; SameSite=Lax BIGipServersjiweb-nginx-app_https=!+UxpwQlMebtfNdfInuzRy4alk/3R/t4gl0VZtKYkoFZtyNeRTx2YbjzCBmMJNLFbeAzr+1hnsrn9Oxc=;Path=/;Version=1;Secure;Httponly __cf_bm=cc1436ed91b8df095cfd2ae0cdf60533a32d4d89-1591746799-1800-ARCPA/er/+cRiHVejNqAfZKftWoeEUU361s0Tf34FLYC7jSX25j7R+totdQq30vwQ01FSbNgE5o+4tuW7Voouik=; path=/; expires=Wed, 10-Jun-20 00:23:19 GMT; domain=.www2.fireeye.com; HttpOnly; Secure; SameSite=None
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 033d19beb30000c83f6fbb8200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5a0ec5778e30c83f-AMS
content-encoding: gzip

GET
H/1.1 200
OK visitWebPage Show response
848-did-242.mktoresp.com/webevents/ 2 B
304 B 936ms
160ms XHR
text/plain 192.28.147.68
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://848-did-242.mktoresp.com/webevents/visitWebPage?_mchNc=1591746799278&_mchCn=&_mchId=848-DID-242&_mchTk=_mch-fireeye.com-1591746799277-11180&_mchHo=www.fireeye.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&_mchPc=https%3A&_mchVr=158&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN53580 (MARKETO, US),
Reverse DNS
Software: akka-http/10.1.11 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 09 Jun 2020 23:53:20 GMT
Content-Encoding: gzip
Server: akka-http/10.1.11
Transfer-Encoding: chunked
X-Request-Id: d5a78cc3-678a-4383-b71d-f376510e152a
Content-Type: text/plain; charset=UTF-8

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 25ms
25ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Tue, 09 Jun 2020 23:53:19 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

GET
H2 200 forms2.min.js Show response
www2.fireeye.com/js/forms2/js/ Frame 2943 203 KB
68 KB 29ms
28ms Script
application/x-javascript 104.17.71.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www2.fireeye.com/js/forms2/js/forms2.min.js

Requested by

Host: www2.fireeye.com
URL: https://www2.fireeye.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.71.206 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www2.fireeye.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1066
status: 200
cf-request-id: 033d19bf750000c83f6fbbe200000001
last-modified: Sat, 06 Jun 2020 07:41:48 GMT
server: cloudflare
etag: "2419c6-32dcc-5a76582a4d00c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5a0ec578bf5ec83f-AMS
expires: Wed, 10 Jun 2020 03:53:19 GMT

GET
H/1.1 200
OK MultiNoun.jsonp Show response
d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/ 497 B
759 B 714ms
109ms Script
text/javascript 13.110.70.53
SALESFORCE

General

Check archive.org

Show headers Download Go to

Full URL

https://d.la1-c1-ia5.salesforceliveagent.com/chat/rest/System/MultiNoun.jsonp?nouns=VisitorId,Settings&VisitorId.prefix=Visitor&Settings.prefix=Visitor&Settings.buttonIds=[573a00000008kP3]&Settings.updateBreadcrumb=1&Settings.urlPrefix=undefined&callback=liveagent._.handlePing&deployment_id=572a0000000H8aJ&org_id=00D3000000063LS&version=34

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.70.53 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl7-ncg1-c6-iad5.la1-c1-ia5.salesforceliveagent.com

Software

Resource Hash

e6048098dc58e8086f6021c3fe014ed234367036a35b89f240e26697e54f1fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: close
Expires: -1

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000244663/ 42 B
909 B 1075ms
312ms Image
image/gif 182.22.30.220
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000244663/?random=1591746799991&cv=9&fst=1591746799991&num=1&fmt=3&value=0&label=ppcGCKvb3mcQ_c2swgM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&tiba=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&hn=www.googleadservices.com&async=1

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

182.22.30.220 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Jun 2020 23:53:20 GMT
Via: http/1.1 mscedge1002.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 14 KB
6 KB 57ms
16ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 09 Jun 2020 22:55:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3445
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5398
x-amz-id-2: 8ar4+qw8ZSKEuiyoLHiQHXLgwtn9R48E2PVj361rsDuR1/wGXJv8gvtrcpegfW1DtBEgB04StxY=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sun, 23 May 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Fri, 17 Apr 2020 10:13:12 GMT
server: ATS
etag: "262ad28777cd04301eaf1ed832269103-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 2CE784BD71112A6E
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: .3pslEVav9FDmkNX3peqHq9djDal2LXy
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 json Show response
fireeye.tt.omtrdc.net/m2/fireeye/mbox/ 10 KB
2 KB 132ms
42ms XHR
application/json 52.19.133.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fireeye.tt.omtrdc.net/m2/fireeye/mbox/json?mbox=target-global-mbox&mboxSession=7d9a72bf8f104b7fbc7bfcc5094af7d9&mboxPC=&mboxPage=f63ff55b3f7443ab9fed820768a3a846&mboxRid=0d849bc77c16454b8970ebf6ccaa52aa&mboxVersion=1.7.1&mboxCount=1&mboxTime=1591754000047&mboxHost=www.fireeye.com&mboxURL=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&mboxReferrer=&browserHeight=1200&browserWidth=1600&browserTimeOffset=120&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&companyRevenueRange=%245B%2B&companyCountry=Belgium&companyIndustry=Transportation%20and%20Logistics&companyName=American%20Airlines&companyRegion=Western%20Europe&companyDomain=aa.com&segments=%5B%22FY2020%20Security%20Effectiveness%20Intent%22%5D
Requested by: Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.133.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-133-54.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 12f01b598c7aec122885d84143c7259b214c3f4c807797c36f375e4bd0e750f2

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jun 2020 23:53:20 GMT
content-encoding: gzip
status: 200
vary: Origin,Accept-Encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.fireeye.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: 0d849bc77c16454b8970ebf6ccaa52aa

GET
H2 200 435600.json Show response
s.yimg.com/wi/config/ 2 B
493 B 457ms
419ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/435600.json

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-request-id: 8603346F75E1A821
x-amz-id-2: MhznmoTGYdhaeJZtetTu2gkoLhlGzkEyP8VAnVNXbzlf3AwVfVJjww4lRZpUDnbEpurZziHg+mQ=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 22

GET
H2 200 sp.pl Show response
sp.analytics.yahoo.com/ 0
530 B 168ms
98ms Script
application/x-javascript 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2009%20Jun%202020%2023%3A53%3A20%20GMT&n=-2d&b=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&.yp=435600&f=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&enc=UTF-8

Requested by

Host: www.fireeye.com
URL: https://www.fireeye.com/etc.clientlibs/clientlibs/granite/jquery/granite/csrf.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 09 Jun 2020 23:53:20 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: ATS
x-frame-options: DENY
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
expires: Tue, 09 Jun 2020 23:53:20 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
130 B 6ms
5ms Image
image/gif 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j82&a=1357683803&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.fireeye.com%2Fblog%2Fthreat-research%2F2017%2F04%2Fcve-2017-0199-hta-handler.html&ul=en-us&de=UTF-8&dt=CVE-2017-0199%3A%20In%20the%20Wild%20Attacks%20Leveraging%20HTA%20Handler%20%7C%20FireEye%20Inc&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Site%20Section&ea=FireEye%20Blogs&el=Threat%20Research&ev=0&_u=aHjAAEAB~&jid=&gjid=&cid=304520131.1591746797&tid=UA-363943-1&_gid=1638235912.1591746799&gtm=2wg5r0MVGC8KK&z=1723044716

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 May 2020 13:50:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1159348
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.fireeye.com
URL: blob:https://www.fireeye.com/d1d78adf-d5b1-4da8-bed9-ab83df743b7f

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

185 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www2.fireeye.com/	1970-01-19 10:09:08	Name: __cf_bm Value: cc1436ed91b8df095cfd2ae0cdf60533a32d4d89-1591746799-1800-ARCPA/er/+cRiHVejNqAfZKftWoeEUU361s0Tf34FLYC7jSX25j7R+totdQq30vwQ01FSbNgE5o+4tuW7Voouik=
.www2.fireeye.com/	1970-01-19 10:52:18	Name: __cfduid Value: dd4b40b43ef07bf1193d972c0dcf80c1c1591746799
www.fireeye.com/	1969-12-31 23:59:59	Name: liveagent_sid Value: c79ad75d-43aa-41d8-a6f3-3a82a3259dda
.fireeye.com/	1970-01-20 03:43:11	Name: mbox Value: session#7d9a72bf8f104b7fbc7bfcc5094af7d9#1591748661\|PC#7d9a72bf8f104b7fbc7bfcc5094af7d9.37_0#1654991601
www2.fireeye.com/	1969-12-31 23:59:59	Name: BIGipServersjiweb-nginx-app_https Value: !+UxpwQlMebtfNdfInuzRy4alk/3R/t4gl0VZtKYkoFZtyNeRTx2YbjzCBmMJNLFbeAzr+1hnsrn9Oxc=
.fireeye.com/	1969-12-31 23:59:59	Name: check Value: true
www.fireeye.com/	1970-01-23 01:47:59	Name: liveagent_ptid Value: 41491a63-db17-4099-b479-1841a3131722
.fireeye.com/	1970-01-19 10:09:08	Name: mboxEdgeCluster Value: 37
.fireeye.com/	1970-01-19 10:09:06	Name: _gat_UA-363943-1 Value: 1
.fireeye.com/	1970-01-20 03:40:18	Name: _ga Value: GA1.2.304520131.1591746797
.addthis.com/	1970-01-19 19:37:54	Name: loc Value: MDAwMDBFVUJFMDAyMzA4MTg0MzAwMDAwMDBDSA==
.fireeye.com/	1970-01-20 03:40:18	Name: _mkto_trk Value: id:848-DID-242&token:_mch-fireeye.com-1591746799277-11180
.fireeye.com/	1970-01-20 03:40:18	Name: vid Value: 9bc1d6ce-8116-40f1-92fc-8fb844124e6e
.fireeye.com/	1970-01-19 10:10:33	Name: _gid Value: GA1.2.1638235912.1591746799
www.fireeye.com/	1970-01-19 10:09:08	Name: __atuvs Value: 5ee020ed70600e04000
.addthis.com/	1970-01-19 19:37:54	Name: uvc Value: 1%7C24
www.fireeye.com/	1970-01-19 19:37:54	Name: __atuvc Value: 1%7C24
www.fireeye.com/	1970-01-23 01:47:59	Name: liveagent_vc Value: 3
www.fireeye.com/	1970-01-23 01:47:59	Name: liveagent_oref Value:

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [bugsnag] Loaded!
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: currentPagePath :: /blog/threat-research/2017/04/cve-2017-0199-hta-handler
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: [object Object]
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: 304520131.1591746797
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	log	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: cookie value
console-api	warning	URL: https://v2.listenloop.com/loop.bundle.js(Line 4) Message: AT: Failed actions [object Object],[object Object]

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	worker-src blob: ; default-src https: data: 'unsafe-inline' 'unsafe-eval';frame-ancestors 'self' http://fireeye.lookbookhq.com https://fireeye.lookbookhq.com http://content.fireeye.com https://content.fireeye.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	ALLOW-FROM https://content.fireeye.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8443343.fls.doubleclick.net
848-did-242.mktoresp.com
abm2.listenloop.com
analytics.twitter.com
app.cdn.lookbookhq.com
attr.ml-api.io
b.6sc.co
b91.yahoo.co.jp
bat.bing.com
c.6sc.co
c.la2c2.salesforceliveagent.com
cloud.typography.com
connect.facebook.net
d.la1-c1-ia5.salesforceliveagent.com
d.la2c2.salesforceliveagent.com
epsilon.6sense.com
fireeye.tt.omtrdc.net
fonts.googleapis.com
googleads.g.doubleclick.net
j.6sc.co
js.maxmind.com
jukebox.lookbookhq.com
jukebox.pathfactory.com
lftracker.leadfeeder.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
px.ads.linkedin.com
s.ml-attr.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.adnxs.com
segment.prod.bidr.io
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tr.lfeeder.com
v1.addthisedge.com
v2.listenloop.com
www.facebook.com
www.fireeye.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www2.fireeye.com
z.moatads.com
s7.addthis.com
www.fireeye.com
104.111.229.31
104.17.71.206
104.244.42.133
104.244.42.67
13.108.250.135
13.110.70.53
13.225.87.105
13.225.87.59
151.101.112.157
172.217.22.66
182.22.30.220
182.22.31.252
184.30.221.218
185.33.221.90
192.28.147.68
2.18.235.40
2001:4de0:ac19::1:b:3b
212.82.100.181
216.58.205.230
23.210.248.44
23.37.59.76
2600:9000:21f3:ca00:1a:2af:6d00:93a1
2606:4700:300b::a29f:f77d
2606:4700:3033::ac43:94cb
2606:4700::6810:262f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::2000
2a00:1450:4001:809::200e
2a00:1450:4001:814::2003
2a00:1450:4001:814::200a
2a00:1450:4001:819::2004
2a00:1450:4001:81b::2008
2a00:1450:4001:821::2002
2a00:1450:400c:c00::9a
2a02:26f0:6c00:28c::25ea
2a03:2880:f058:f:face:b00c:0:3
2a03:2880:f158:82:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.232.27.189
34.236.162.82
52.16.156.50
52.19.133.54
52.57.146.39
52.85.121.13
54.164.226.178
68.67.153.60
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
079c30478215da1e544443314dabb6ab1251fa2ae56447ace992ade3bbe3fd0c
0b6b811536ee539109f82adae5b42aeb30972076c3f00189f87015121c862dc7
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
110a7cc091a04f8daa03248a7d0d3da1d8a24afc919aedd82ae884ddf49ac6ba
12f01b598c7aec122885d84143c7259b214c3f4c807797c36f375e4bd0e750f2
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
1c7c6cbe8b5beb7e138cfcc8f6301d21b35437e5559be7afd0afe3f536d5fc02
1cddcd88d3332d560856627ab2cecc7d9aa6c9d616729701ae13902d1671d0b0
1de5a2b057fc1fd85e8b3ccffa91101c8304a88b32fccb33e19d7657a1460dae
24b7b2f7b99ef95b2f4fbd89f372e734216c11d8467af0e795f354937b461e21
2a681cca9fc0504acacb6157248b780c9cbaff015575f4d30f5ab0756329ebeb
2f1fd973e6c48489ae07c467e3278635b856c698d1f502e06af3ab555937deac
30b92b1d67692c95ef6d322b21cb9e0c2f7d5a4c68c05b4e3e3e87489ec41309
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
325788f630aa3ff90d75e60d764ebba3adf2d304671b57e327fe3801bbdad9de
355604a949ef95ceffcd21a7e9b5ed27c95d847f95127e0ddad5aa1793f1bb74
397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b
3aadac47cf44df595934bec631a78bf2ba62081ab95528e684a85b4c74453e77
3ad14083a44381b16ac11c3d013c61ef822cefd107da423fafeb476e77c0402a
3e10cbbf23a20b5282287e1cec45fae4af6af4097d2e4cf5154605cc9e8d91d3
402d6993a8d8e50da41d6f5e34d7206e4b61ba74599617c7ea4c513afdf5b1c8
4086c8cd4c3361452c1c1da9af3034fc90f4a375c4f6195f31d6dcf1c7b56f00
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
43f29aa55ae9e0fa1776400cf941f586d26f69ae26061290cf97bc90c30afa4e
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
48dca69d4a48f11abaa7e1a0d846cb4484c0c4fe7ca90552fa7483b1e53ab74b
49b21abffd2ad2c12a328ca91ad0fbbb6bfd2e1f57aacf95cc236077c0bac9ff
4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787
4e040b6884ad0623aece79feb28b75ee490c568a930c6bbfd83255d058d54611
4ecd284b8811543e88f4c470ba7b3fe3f4b7a458c512bb92ab41d2b491aee6ca
5062a8070951a1c77103a1bb6d96a11f185c50e4ee7b317320a8588243f6d828
51a816d6236c852abc450f36cb5875e0713a1345aa7eeefe5517f84182ab37b2
5535d2c567dac9fb9a8eb888a5415164e87c4aa6f08f70a6cc6ab1c0cd3bac12
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56bf97572cc7de5a19131a062e5e0e64ffa38dc71e87cdfa7c0e481e15f2d628
573e3529383c85c696d55c17aecbf20d1fbbdd9c3fe96005d3c00e3dbd024e3a
5b54138a1228bb354b4d200ba40bca6e8bf05c3476b3013daf8fa8162a414582
5b701db4813b82b18ad7f0db593b1dcc5c435f7be396ef3a937f8ed1ec7b343d
5c5897b5e08c97222ea272f227de1047961dce826ff8c7ef4761937a7528dc8e
5f967fd41346c0fc1b9b44fa69c52bf1e754420c59c8017cefb0a14a764cafa4
643c63b7d42c3a8ac70f3de4f817f2a782f16d5442067adafbb63c8af7ea31fb
6a822b86cffdec9e6739059198523e360e121ecdfbe43c51703c6626c802f843
757eb886edd9a887fc95b701c88b08191eb743657027636c0c9d4973547ebb4a
78a81c2a32cbd6675976ff2074623000dafc3e80bf6698801b9e369c0656a89c
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
79b2448738716f0daf11d4a206e105e3b79e9d082f9c9bf4ad2bd55e591a1a3c
7bf2a2b56626880433a43cb7937e23adecb2bd80821052bd534247c5f10bff62
7d6fd646e0efeb5d1209c2d9008343cb061cc7d70408fbd108f683dbc4d17fa8
82755a4b4ba68c6b1fa4b548071ec6570f5bb3ed089bb699a8646a3c5e8991e8
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84a91ff2a1a995e3816750f53342b4499bfefc817a8ee1a5d4b401433692d510
868f9a43f4f56d4aadd7518da30788192afc3f5ba266a35d9d638682120dfdbd
88ffa93972fd10cb77f72406f1fa886a814dec52adb5f86c151f23fa2da55a4a
94a4bb6bd947da2837eeab294d95484a94edc8ffbd0693378a5d24e920979c31
985463905919b26c7876284079da3e08a41e6abded151f6d0be888bcbc54d2a0
9b935949913b686e1e44928fb476ad5611303afc06e844ff620f59370d9c77bd
9c450c93603dd9bfa4f7ec95c6149d3e3d2bad386a1fd47db304f1ede945ce95
a0a0933f843198c607baaf63f153e3fb5fd900d91f31d37d0f71b53ca66c4ab9
a1fee6d4ba81c4fc4941c791118ccb9df8e515feb7e75edc3defe85ad6ddcc28
a651134a4ed674e6fd28722d2576ce19bf8e0699e5b388c3eb9f8d485bbfcfe5
ab59e15d34a0a1beb052fde1b9e029045a2281c2ffa267e7a17d0e2dd8289584
ac6ae3e18713f0af9681e92e3b172a8a421543f4f42153457ce40498a5fbb3fc
ac8511a575f9ff43c005f8be9f0fb7b81b8aebf2fd2e1df8df7809df4b77cc07
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aeb54739ad664ca0dde2785d1a4c64495b8d91e7eee6ab4d7788769655746f88
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b397476bcbcf8c9eae3f82007cc4f9495661b367e02e6d3dea6e15f0610ef20a
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
c084b47104c493fb377b6d35d8c08df67d773f6dcf8294c0a7360710cd8cacbd
c7d7214a0b940c1ffcbd64689a576c5847b42e886da3ad9ea45bc4cda214bac8
c986afd07a4082d65befeef18869a4cd5e00f3ac6e8228d49658802c7453a1b8
cd34ee8ae406b1662e7ef53583b899f9ccc52d0920127c4716c6944a68916cd5
d20cf953b941d38ca8b450334f135fbe787dc4cb8371f4032fda9337cbfd5836
d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0
d4eae71ff47319b9bcb824e70dbfbe6da1be9fa875552c57e5fe557587010406
d9bba1001def66054e4cb1f3880abf4b19483b35891af50e302c19260bbec0b9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df920dd3acb5daee7f0dc0105aacb3d1bc37fcefc0f83da92349fb1d40d573d3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e55596fc1c3349cbbc926529c29c27e1de7b98b47a31cc7bb4789970e571065f
e6048098dc58e8086f6021c3fe014ed234367036a35b89f240e26697e54f1fc0
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f20b7aacff69fbfc6fc0aaff9220bab48d3ce87c45bd077fea61e5d9e7662c2c
f7b31177a5f3a934fd7d86abd3a7c9c0100dc1f299bdce1cddfc946b2c42b4e3
fbcc2c7d4dfbc5d0251c789843b8d7edf25306dfa23188ad267e2786357233c0

www.fireeye.com Open in urlscan Pro 2606:4700:300b::a29f:f77d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

97 Requests

98 %HTTPS

40 %IPv6

41 Domains

52 Subdomains

43 IPs

9 Countries

2571 kBTransfer

5571 kBSize

19 Cookies

25 Outgoing links

Redirected requests

97 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fireeye.com Open in urlscan Pro
2606:4700:300b::a29f:f77d Public Scan

Screenshot
Live screenshot

Full Image

97
Requests

98 %
HTTPS

40 %
IPv6

41
Domains

52
Subdomains

43
IPs

9
Countries

2571 kB
Transfer

5571 kB
Size

19
Cookies

97 HTTP transactions
8 data transactions