www.mandiant.com Open in urlscan Pro
162.159.241.125 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Effective URL:
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Submission: On February 25 via api (February 25th 2024, 9:29:22 pm UTC) from IL — Scanned from IL

Summary HTTP 87 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 29 IPs in 3 countries across 24 domains to perform 87 HTTP transactions. The main IP is 162.159.241.125, located in and belongs to CLOUDFLARENET, US. The main domain is www.mandiant.com. The Cisco Umbrella rank of the primary domain is 363817.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 2nd 2023. Valid for: a year.

This is the only time www.mandiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.159.240.125 162.159.240.125	13335 (CLOUDFLAR...) (CLOUDFLARENET)
19	162.159.241.125 162.159.241.125	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.217.18.106 172.217.18.106	15169 (GOOGLE) (GOOGLE)
12	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
1	172.66.41.45 172.66.41.45	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	142.250.186.164 142.250.186.164	15169 (GOOGLE) (GOOGLE)
3	172.67.39.148 172.67.39.148	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.186.104 142.250.186.104	15169 (GOOGLE) (GOOGLE)
1	146.75.120.157 146.75.120.157	54113 (FASTLY) (FASTLY)
1	2.18.64.220 2.18.64.220	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	157.240.253.1 157.240.253.1	32934 (FACEBOOK) (FACEBOOK)
3	204.79.197.200 204.79.197.200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	172.217.18.14 172.217.18.14	15169 (GOOGLE) (GOOGLE)
1	3.162.38.9 3.162.38.9	16509 (AMAZON-02) (AMAZON-02)
2	184.31.85.59 184.31.85.59	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.17.67.65 104.17.67.65	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	216.239.36.181 216.239.36.181	15169 (GOOGLE) (GOOGLE)
2	74.125.71.157 74.125.71.157	15169 (GOOGLE) (GOOGLE)
1	142.250.186.67 142.250.186.67	15169 (GOOGLE) (GOOGLE)
2	52.71.29.144 52.71.29.144	14618 (AMAZON-AES) (AMAZON-AES)
2	13.32.27.54 13.32.27.54	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
3 5	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	157.240.253.35 157.240.253.35	32934 (FACEBOOK) (FACEBOOK)
8	2.19.120.10 2.19.120.10	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.38.98.119 23.38.98.119	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
87	29

1 162.159.240.125 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 162.159.241.125 (None, )

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.41.45 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn4.iconfinder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.186.164 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.67.39.148 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.120.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.64.220 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-18-64-220.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.253.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-fra5.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 204.79.197.200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
PTR: a-0001.a-msedge.net

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.18.14 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.162.38.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-162-38-9.cdg52.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.85.59 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-85-59.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.67.65 (None, )

ASN13335 (CLOUDFLARENET, US)

scout-cdn.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.36.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.71.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wn-in-f157.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f3.1e100.net

www.google.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.71.29.144 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-29-144.compute-1.amazonaws.com

scout.salesloft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.27.54 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-54.fra56.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

565-pei-952.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.253.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-fra5.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.19.120.10 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-19-120-10.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.38.98.119 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-38-98-119.deploy.static.akamaitechnologies.com

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	mandiant.com 1 redirects www.mandiant.com — Cisco Umbrella Rank: 363817	909 KB
12	gstatic.com www.gstatic.com	1 MB
10	google.com www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 159	77 KB
9	6sc.co j.6sc.co — Cisco Umbrella Rank: 5326 c.6sc.co — Cisco Umbrella Rank: 8195 ipv6.6sc.co — Cisco Umbrella Rank: 5498 b.6sc.co — Cisco Umbrella Rank: 3594	21 KB
5	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 350 www.linkedin.com — Cisco Umbrella Rank: 615	3 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
3	salesloft.com scout-cdn.salesloft.com — Cisco Umbrella Rank: 9973 scout.salesloft.com — Cisco Umbrella Rank: 12586	4 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 710 script.hotjar.com — Cisco Umbrella Rank: 961	62 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 368	14 KB
3	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3747	28 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 85	394 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3542	6 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	69 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	208 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	185 B
1	mktoresp.com 565-pei-952.mktoresp.com	318 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 802	395 B
1	t.co t.co — Cisco Umbrella Rank: 660	376 B
1	google.co.il www.google.co.il — Cisco Umbrella Rank: 16594	408 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 805	16 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 783	15 KB
1	iconfinder.com cdn4.iconfinder.com — Cisco Umbrella Rank: 98548	5 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 32	2 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 226	5 KB
87	24

	Domain	Requested by
20	www.mandiant.com	1 redirects www.mandiant.com
12	www.gstatic.com	www.mandiant.com www.google.com www.gstatic.com
9	www.google.com	www.mandiant.com www.gstatic.com www.google.com
6	b.6sc.co
4	px.ads.linkedin.com	2 redirects www.mandiant.com snap.licdn.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.mandiant.com
3	static.addtoany.com	www.mandiant.com static.addtoany.com
2	script.hotjar.com	static.hotjar.com script.hotjar.com
2	scout.salesloft.com	scout-cdn.salesloft.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	munchkin.marketo.net	www.mandiant.com munchkin.marketo.net
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
2	www.googletagmanager.com	www.mandiant.com www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	j.6sc.co	www.mandiant.com
1	www.facebook.com	www.mandiant.com
1	565-pei-952.mktoresp.com	munchkin.marketo.net
1	www.linkedin.com	1 redirects
1	analytics.twitter.com	www.mandiant.com
1	t.co	www.mandiant.com
1	www.google.co.il	www.mandiant.com
1	analytics.google.com	www.googletagmanager.com
1	scout-cdn.salesloft.com	www.mandiant.com
1	static.hotjar.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	cdn4.iconfinder.com	www.mandiant.com
1	fonts.googleapis.com	www.mandiant.com
1	cdnjs.cloudflare.com	www.mandiant.com
87	31

This site contains links to these domains. Also see Links.

Domain
cloud.google.com
careers.google.com
login.mandiant.com
www.mandiant.fr
www.mandiant.de
www.mandiant.it
www.mandiant.jp
www.mandiant.kr
www.mandiant.es
www.facebook.com
twitter.com
www.youtube.com
www.linkedin.com
selling.mandiant.com
policies.google.com

Subject Issuer	Validity	Valid
mandiant.com Cloudflare Inc ECC CA-3	`2023-04-02` - `2024-04-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
iconfinder.com E1	`2024-01-31` - `2024-04-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
static.addtoany.com E1	`2024-02-24` - `2024-05-24`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-05` - `2024-03-04`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
*.hotjar.com Amazon ECDSA 256 M03	`2024-02-07` - `2025-03-08`	a year	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
salesloft.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-20` - `2024-04-18`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.co.il GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Frame ID: 273E89AA408D22216EBBD96AA5597D53
Requests: 70 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 8ED7BD6C4EBA6C19DAA44597A4B4C2D4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=bb62aat6qqgg
Frame ID: 543818D94A55F0C30EDA1B14D3CB418F
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=compact&cb=lqhc0wy8jett
Frame ID: 8BCBA28C71541928D0D8673940F468CE
Requests: 5 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 863F50A0B48B4F17AB3838377A10199B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq
Frame ID: 094AE6E24F9D41B05881CC985A6EAD98
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

404 page | Mandiant

Page URL History Show full URLs

http://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation HTTP 301
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Page URL

Detected technologies

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"
/recaptcha/api\.js

Page Statistics

87
Requests

98 %
HTTPS

0 %
IPv6

24
Domains

31
Subdomains

29
IPs

3
Countries

2561 kB
Transfer

6567 kB
Size

27
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://cloud.google.com/security/sec-ops
Title: Breach Analytics for Chronicle Know what we know when we know it

Search URL Search Domain Scan URL

URL: https://careers.google.com/
Title: Careers Life at Mandiant and open roles

Search URL Search Domain Scan URL

URL: https://login.mandiant.com/
Title: Sign in to Advantage

Search URL Search Domain Scan URL

URL: https://www.mandiant.fr/
Title: Français

Search URL Search Domain Scan URL

URL: https://www.mandiant.de/
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://www.mandiant.it/
Title: Italiano

Search URL Search Domain Scan URL

URL: https://www.mandiant.jp/
Title: 日本

Search URL Search Domain Scan URL

URL: https://www.mandiant.kr/
Title: 한국어

Search URL Search Domain Scan URL

URL: https://www.mandiant.es/
Title: Español

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Mandiant

Search URL Search Domain Scan URL

URL: https://twitter.com/Mandiant

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCexu0DP7VKdDByusuTA53FQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/mandiant/

Search URL Search Domain Scan URL

URL: https://selling.mandiant.com/mandiant/sso.aspx
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?hl=en-US
Title: Website Privacy Policy

Search URL Search Domain Scan URL

URL: https://cloud.google.com/product-terms#section-15
Title: Terms & Conditions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation HTTP 301
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 48

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1708896556302%26li_adsId%3D08b1d223-198d-4498-a35d-821dd4beb7e9%26url%3Dhttps%253A%252F%252Fwww.mandiant.com%252Fresources%252Fblog%252Finvestigating-ivanti-zero-dayexploitation%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&cookiesTest=true&liSync=true

87 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request investigating-ivanti-zero-dayexploitation Show response
www.mandiant.com/resources/blog/
Redirect Chain

http://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

77 KB
17 KB

914ms
694ms

Document
text/html

162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8c0404cf93d4893ffa5fd999919ab905334a31b9e4ae0631eb8c3512b868308

Security Headers

Name	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

cache-control: public, max-age=86400
cf-cache-status: MISS
cf-ray: 85b30ae67a149241-FRA
content-encoding: gzip
content-language: en
content-security-policy: report-uri /report-csp-violation
content-type: text/html; charset=UTF-8
date: Sun, 25 Feb 2024 21:29:14 GMT
expect-ct: max-age=86400
expires: Mon, 26 Feb 2024 21:29:14 GMT
last-modified: Sun, 25 Feb 2024 21:27:20 GMT
referrer-policy: strict-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Cookie, Accept-Encoding
via: varnish
x-ah-environment: prod
x-cache: HIT
x-cache-hits: 2
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: v-a8441dda-d424-11ee-94d3-f7f469783dfd
x-xss-protection: 1; mode=block

Redirect headers

CF-RAY: 85b30ae44f2c1c03-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sun, 25 Feb 2024 21:29:13 GMT
Expires: Sun, 25 Feb 2024 22:29:13 GMT
Location: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 css_KFnusKHcf5pIK0Vw29oasMB1lthBihlY249xusuony4.css
www.mandiant.com/sites/default/files/css/ 23 KB
5 KB 635ms
634ms Stylesheet
text/css 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_KFnusKHcf5pIK0Vw29oasMB1lthBihlY249xusuony4.css?delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cdc249fe2d6f4d8e895f3033d11e4b917dcfa03ef5447665ba53b92192a59f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 5265
x-request-id: v-eb047144-d328-11ee-bf54-a7fd7caa4146
last-modified: Sat, 24 Feb 2024 15:24:55 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aeaec2d9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css
www.mandiant.com/sites/default/files/css/ 707 KB
83 KB 537ms
535ms Stylesheet
text/css 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a7b82ca2e7779906e5ed103e6aea92ad41856bf2265ac009947b59b0d752f06

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: MISS
x-ah-environment: prod
content-length: 84381
x-request-id: v-f75ae954-d2f7-11ee-a6d6-2b704afb2743
last-modified: Fri, 23 Feb 2024 15:55:21 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aeaec2e9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/ 23 KB
5 KB 190ms
76ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.3.0/css/font-awesome.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:14 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 8627240
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4364
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-5cbb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t8ISBiHgesAgQB%2FyLnVyhfcS3n1atZtTccC1VdHIrF4VDtZZbHI7zdNxHrDFl5W2FjoBepOVH3idWLzaU26o3uCABeYxOW%2FsgeVc0Rn66iBrm0HTUTe3hcIrG2Pw4lvvh66AADCz"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 85b30aeb6defe3cb-TLV
expires: Fri, 14 Feb 2025 21:29:14 GMT

GET
H2 200 css2
fonts.googleapis.com/ 10 KB
2 KB 348ms
118ms Stylesheet
text/css 172.217.18.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Google+Sans+Text:wght@400&family=Google+Sans:wght@500&display=swap

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f10.1e100.net

Software

ESF /

Resource Hash

a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 25 Feb 2024 21:29:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 25 Feb 2024 21:24:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 25 Feb 2024 21:29:14 GMT

GET
H2 200 cookienotificationbar.min.css
www.gstatic.com/glue/cookienotificationbar/ 9 KB
2 KB 373ms
143ms Stylesheet
text/css 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1670
x-xss-protection: 0
last-modified: Sun, 25 Feb 2024 17:07:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Sun, 25 Feb 2024 21:29:14 GMT

GET
H2 200 icon-close-512.png
cdn4.iconfinder.com/data/icons/ionicons/512/ 4 KB
5 KB 211ms
77ms Image
image/webp 172.66.41.45
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn4.iconfinder.com/data/icons/ionicons/512/icon-close-512.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.66.41.45 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 310411
cf-polished: origFmt=png, origSize=8351
content-disposition: inline; filename="icon-close-512.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3858
x-request-id: b91cf936-23cc-4645-afd8-5be66ad3a7fb
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1706738852&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=TPWdAamE1l9dUqJDJtMOw2nKaTcDLVPhDZ3fFRATclE%3D
cf-bgj: imgq:100,h2pri
last-modified: Tue, 20 Feb 2024 10:17:29 GMT
server: cloudflare
vary: Accept
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1706738852&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&s=TPWdAamE1l9dUqJDJtMOw2nKaTcDLVPhDZ3fFRATclE%3D"}]}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 85b30aefba33e3d3-TLV
expires: Mon, 24 Feb 2025 21:29:15 GMT

GET
H2 200 hero-short-bg.jpg
www.mandiant.com/sites/default/files/2021-08/ 56 KB
56 KB 604ms
604ms Image
image/jpeg 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/sites/default/files/2021-08/hero-short-bg.jpg

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1cd8e9c3c0e2ec3111f46d6ba125fe1726b7933055503563d7d88ec48089ea8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2806
date: Sun, 25 Feb 2024 21:29:15 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 57567
x-request-id: v-f71eef12-d22f-11ee-86e6-c3e2eaf7896d
last-modified: Mon, 16 Aug 2021 23:56:30 GMT
cf-bgj: h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aeb2c4a9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 js_7zAReM_HUAmw41EQQUFe40J6XbXd3rHrgP0gXXSV8E8.js Show response
www.mandiant.com/sites/default/files/js/ 95 KB
33 KB 583ms
582ms Script
text/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_7zAReM_HUAmw41EQQUFe40J6XbXd3rHrgP0gXXSV8E8.js?scope=footer&delta=0&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: MISS
x-ah-environment: prod
content-length: 33292
x-request-id: v-08f6e1cc-d2f8-11ee-a883-a365288d700d
last-modified: Fri, 23 Feb 2024 17:35:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aeb3c4b9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 349ms
121ms Script
text/javascript 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

1916ec439c6efb5e417e64c3b2db0f06a16b6308972312f0060b202356fcfad8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 25 Feb 2024 21:29:15 GMT

GET
H2 200 js_9U4wXz9XW2GifJniOf90JXkItJOB-QWsNleF4ejbXgU.js Show response
www.mandiant.com/sites/default/files/js/ 3 KB
1 KB 516ms
516ms Script
text/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_9U4wXz9XW2GifJniOf90JXkItJOB-QWsNleF4ejbXgU.js?scope=footer&delta=2&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 1
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 1063
x-request-id: v-079e24c0-d2f8-11ee-9c4f-d31c3e0d44e2
last-modified: Fri, 23 Feb 2024 15:53:54 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aeefe099241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 205ms
89ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 28774
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"257f9651f9cfd949f6dde30f51352116"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2R3eCBu%2Bb5A3rW828g1DES5LpzfFa7lV4VX2XWhEzCZ9U%2Bsg%2Bpitw6WavBYDzeAB9luyWDAeV29jz49I5IeNw4x2q7jcMUxzBE0yUn%2Ft4t2waXSo16ueVPhnSib8gv2RoUq6WfgoN0LNFHPowJElApvt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 85b30aef9d61e3db-TLV

GET
H2 200 js_5frFz0zzgAhAfGtV84tLqZjD8uuI8PsbqDTdswqYbUI.js Show response
www.mandiant.com/sites/default/files/js/ 416 KB
124 KB 564ms
561ms Script
text/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_5frFz0zzgAhAfGtV84tLqZjD8uuI8PsbqDTdswqYbUI.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 1
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 126527
x-request-id: v-0790c348-d2f8-11ee-bbf7-9f8d0422d07f
last-modified: Fri, 23 Feb 2024 15:54:01 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e479241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 accordion.frontend.min.js Show response
www.mandiant.com/modules/contrib/ckeditor_accordion/js/ 4 KB
2 KB 560ms
557ms Script
application/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/modules/contrib/ckeditor_accordion/js/accordion.frontend.min.js?s9bg23

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 108676
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
age: 129268
x-cache: HIT
x-ah-environment: prod
content-length: 1535
x-request-id: v-f2f953be-d2f7-11ee-aa52-fbd66b4db0c9
last-modified: Wed, 24 Jan 2024 07:40:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e489241-FRA
expires: Sat, 09 Mar 2024 09:34:47 GMT

GET
H2 200 js_3QJ5V3UCov_ix22PGyPCKOFfGHsbjPo4ZLg1yEnge7s.js Show response
www.mandiant.com/sites/default/files/js/ 20 KB
6 KB 588ms
586ms Script
text/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/sites/default/files/js/js_3QJ5V3UCov_ix22PGyPCKOFfGHsbjPo4ZLg1yEnge7s.js?scope=footer&delta=6&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 1
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 6309
x-request-id: v-078be864-d2f8-11ee-b427-07e081657901
last-modified: Fri, 23 Feb 2024 15:53:54 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e499241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 cookienotificationbar.min.js Show response
www.gstatic.com/glue/cookienotificationbar/ 18 KB
7 KB 144ms
141ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

74397437d41d0ef91b6ac1cbd4edb0c5fb809cd9299cccf6adde7b5b8937e79f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6872
x-xss-protection: 0
last-modified: Sun, 25 Feb 2024 17:07:29 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Sun, 25 Feb 2024 21:29:15 GMT

GET
H2 200 fontloader.built.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 7 KB
2 KB 588ms
586ms Script
application/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/fontloader.built.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2376
date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 2334
x-request-id: v-e80cff00-d22f-11ee-a482-73a343d1abb6
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e4b9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 412 KB
116 KB 365ms
136ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

59baae98dcb18f9f30f94f260fa83ed455233d33cc6b5900b4210560337cd09c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 118317
x-xss-protection: 0
last-modified: Sun, 25 Feb 2024 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 25 Feb 2024 21:29:15 GMT

GET
H2 200 footer-bg-transparent.png
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/ 134 KB
134 KB 568ms
567ms Image
image/png 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/images/footer-bg-transparent.png

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2788
date: Sun, 25 Feb 2024 21:29:15 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 136986
x-request-id: v-e6455e6a-d22f-11ee-9fc2-1f1e000301c6
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e4c9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H2 200 MaterialIcons-Outlined.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/ 148 KB
148 KB 563ms
563ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/material-icons/MaterialIcons-Outlined.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 3741
date: Sun, 25 Feb 2024 21:29:15 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 151244
x-request-id: v-e3f37854-d22f-11ee-b2aa-03c6c229989e
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30aef5e4e9241-FRA
expires: Sun, 10 Mar 2024 21:29:15 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ 518 KB
198 KB 339ms
111ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=CaptchaCallback&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 00:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421677
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Feb 2025 00:21:18 GMT

GET
H2 200 sm.25.html Show response
static.addtoany.com/menu/ Frame 8ED7 716 B
739 B 79ms
78ms Document
text/html 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

access-control-allow-origin: *
age: 28759
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 85b30af21b44e3db-TLV
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 25 Feb 2024 21:29:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gaiZRQvpuRSMm8YcMjIDXibI4AwXJb6xuZK0RQTiZkMwxQovCQhxWR2%2FHPlJHVgvdOyqL0KKW1Pgmvxy0%2F5IjO3iqcubo18ylMDNm1vaOsQQQDA5bn6t3kdVIzE8WrKFLSBjmD4O"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 core.Ep5bSEmr.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 137ms
76ms Script
application/javascript 172.67.39.148
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1525
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"a995aaed2cd978eb5749462d1dc3635e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=La%2BSQzIeKjiF%2B%2FFGy17cv6IBbVFmZ6V49L%2FlVkMGRXb1z0kS7XMjpkH3SRk1TxdBsX7NZ68Ks%2FXrnhUHNZc0j15gPtpmn8DilOZsKYTxEWZGSz%2Bc95JcDz0jAyP7zT%2FPDBWY69Zk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 85b30af27807e3cf-TLV

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 280 KB
92 KB 126ms
125ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

8a2c8237ce87e24ac94b20ff21c0fbd9459864892a5940921c6def6b6d1343a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 94458
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 25 Feb 2024 21:29:15 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 348ms
113ms Script
application/javascript 146.75.120.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 18:55:37 GMT
x-amz-server-side-encryption: AES256
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100147-IAD, cache-fra-etou8220091-FRA

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 45 KB
16 KB 366ms
112ms Script
application/javascript 2.18.64.220
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.64.220 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-18-64-220.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9841d9258210b13f0870a80d02ce8f3224c8798d1c0d618f210a573ce96038e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 20 Feb 2024 09:12:49 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=70142
accept-ranges: bytes
content-length: 16480

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 388ms
167ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 25 Feb 2024 21:29:16 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: DJdwcL1zQ6GL/7zx9y0ItCfbbAL1C0m9VyDGmFNz7RxHf1ojfi6yrSvLg/mHP5OaIAmktsyxEMCM/7WRIbVe8g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 320ms
132ms Script
application/javascript 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

45396b8359112c614d4aab3fcb716deaabc47e477078f675d7bf69f5791c8f53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sun, 25 Feb 2024 21:29:16 GMT
last-modified: Thu, 22 Feb 2024 21:00:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 30384406F10F423EB3B798BDE0141451 Ref B: TLV30EDGE0306 Ref C: 2024-02-25T21:29:16Z
etag: "0adee36d265da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13197

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 352ms
115ms Script
text/javascript 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 25 Feb 2024 19:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6067
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 25 Feb 2024 21:48:09 GMT

GET
H2 200 hotjar-3008912.js Show response
static.hotjar.com/c/ 9 KB
4 KB 351ms
111ms Script
application/javascript 3.162.38.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T72STLD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.162.38.9 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-162-38-9.cdg52.r.cloudfront.net

Software

Resource Hash

cde0ec44099aedd320856a4c527ba897b63e1a4915f7e4e00b63d9a35df77f88

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
date: Sun, 25 Feb 2024 21:28:51 GMT
via: 1.1 e3a22956d967223c0e78cf3ccbf67b6c.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG52-P6
age: 25
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
etag: W/7384cd9a9ab7bb4b485274513882a5bc
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cache-control: max-age=60
x-amz-cf-id: UexufAi7_pY9AML2WUsIE1EvDExb0F5s9IoMKAqzsZtFZLBBmRz-hQ==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 359ms
116ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sun, 25 Feb 2024 21:29:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 sl.js Show response
scout-cdn.salesloft.com/ 6 KB
3 KB 258ms
82ms Script
application/javascript 104.17.67.65
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://scout-cdn.salesloft.com/sl.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.67.65 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
x-amz-version-id: 6anzvBQcvmaBDc8BSO9zI6Th.IIiwArc
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-request-id: 8PPETXCSK5NZ9HQZ
age: 6314
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 0I75wyzSFJBp5Rl/J8W6o3nDdgp09Py6hwVjSRsgT33MOM+ZP4XpT2XOL7b21IOcTxlYctLjNRM=
last-modified: Mon, 13 Dec 2021 16:28:37 GMT
server: cloudflare
etag: W/"d74cc4825c8e333b2116da3fcc649db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 85b30af37c25e3d7-TLV
expires: Mon, 26 Feb 2024 01:29:16 GMT

GET
H2 200 974.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 11 KB
3 KB 520ms
520ms Script
application/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/974.bundle.js?ed9f0d

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/sites/default/files/js/js_5frFz0zzgAhAfGtV84tLqZjD8uuI8PsbqDTdswqYbUI.js?scope=footer&delta=4&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2547
date: Sun, 25 Feb 2024 21:29:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 3375
x-request-id: v-e882faac-d22f-11ee-aa0e-33bfb0da28d6
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af3483e9241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H2 200 404.bundle.js Show response
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/ 406 B
368 B 503ms
503ms Script
application/javascript 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/scripts/404.bundle.js?2c5f80

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2552
date: Sun, 25 Feb 2024 21:29:16 GMT
content-encoding: gzip
via: varnish
cf-cache-status: REVALIDATED
x-content-type-options: nosniff
x-cache: HIT
x-ah-environment: prod
content-length: 263
x-request-id: v-e6264066-d22f-11ee-9205-5f441861c718
last-modified: Wed, 26 Oct 2022 19:55:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af3483f9241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H3 200 2a.json Show response
www.gstatic.com/glue/cookienotificationbar/config/ 22 B
67 B 147ms
146ms Fetch
application/json 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/config/2a.json?hl=en

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

a0a1f98fca203b8561519a06bacfdc50e4b3c4a5a71e740da5b0875bd4fc00d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
last-modified: Mon, 15 May 2023 09:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
expires: Sun, 25 Feb 2024 21:29:16 GMT

GET
H2 200 Barlow-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 511ms
511ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 4337
date: Sun, 25 Feb 2024 21:29:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 56020
x-request-id: v-e032a776-d22f-11ee-b972-3f1105e45523
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af3684e9241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H2 200 PTMono-Regular.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/ 71 KB
71 KB 226ms
226ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/mono/PTMono-Regular.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 5
date: Sun, 25 Feb 2024 21:29:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 72380
x-request-id: v-f60fe950-d2f7-11ee-9665-bbb794cf83dc
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af368529241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
255 B 294ms
110ms Ping
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=45je42l0v883779794z8849727317za220&_p=1708896555308&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&cid=1518872160.1708896556&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=1&sid=1708896556&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&dt=404%20page%20%7C%20Mandiant&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2600
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 332ms
111ms Ping
text/plain 74.125.71.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-X6642ZTDJ7&cid=1518872160.1708896556&gtm=45je42l0v883779794z8849727317za220&aip=1&dma=0&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6642ZTDJ7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.71.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wn-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.il/ads/ 42 B
408 B 364ms
136ms Image
image/gif 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-X6642ZTDJ7&cid=1518872160.1708896556&gtm=45je42l0v883779794z8849727317za220&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&z=2065909852

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 r Show response
scout.salesloft.com/ 41 B
358 B 597ms
192ms XHR
application/json 52.71.29.144
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMDUwMDl9.GHpZgHyRyFl9iN7anlcbMbmW3chPCQZrSX98AJ7UjM8

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.71.29.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-71-29-144.compute-1.amazonaws.com

Software

Resource Hash

1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 41
x-request-id: 79de894b4c2b48754e409a1abd16a7d3

GET
H2 204 5870833.js Show response
bat.bing.com/p/action/ 0
117 B 131ms
130ms Script
text/plain 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5870833.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Sun, 25 Feb 2024 21:29:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 150512045B4743F4945D75A9D5580760 Ref B: TLV30EDGE0306 Ref C: 2024-02-25T21:29:16Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
287 B 143ms
143ms Image
text/plain 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5870833&tm=gtm002&Ver=2&mid=56208f32-fe5b-488e-a9cb-d14c43f7de90&sid=ed6db5f0d42411eebe3b1b1c408ecb70&vid=ed6db660d42411eeb91c35a82d5c1f37&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=404%20page%20%7C%20Mandiant&p=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&r=&lt=2542&evt=pageLoad&sv=1&rn=781977

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 25 Feb 2024 21:29:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C92B2100F67A45489BBEAC03E839DF2E Ref B: TLV30EDGE0306 Ref C: 2024-02-25T21:29:16Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.3ba69200791f16077ba8.js Show response
script.hotjar.com/ 228 KB
55 KB 364ms
131ms Script
application/javascript 13.32.27.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.3ba69200791f16077ba8.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-3008912.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-54.fra56.r.cloudfront.net

Software

Resource Hash

c60a1c9a37989557aed8884899ddec28096d9624f4b43c602f9b335ae1db25cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Thu, 22 Feb 2024 11:39:06 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 07fbd2276304c86925071791c7032950.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 294610
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 56245
last-modified: Thu, 22 Feb 2024 11:38:42 GMT
etag: "35c74e10d354e1166c41fd72674e0488"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: YXTtt0QbgSFD9os1ko7EfAR5inq-OsBYTdHn-N-9J_A_KQWsWWsfKg==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 112ms
111ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sun, 25 Feb 2024 21:29:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Tue, 04 Jun 2024 21:29:16 GMT

GET
H2 200 adsct
t.co/i/ 43 B
376 B 454ms
219ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=714b4c96-f687-4870-8fbe-790469fdbeec&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7d68b85d-ad7b-4afb-84b8-92ef20d6e786&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.29

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 103
date: Sun, 25 Feb 2024 21:29:15 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 117e70f3a059c9c6
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 94fe7a9018cd922c7b0cf8408e17e252bbd7c26088a07f1a70644b225cbdc6aa
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 525ms
287ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=714b4c96-f687-4870-8fbe-790469fdbeec&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=7d68b85d-ad7b-4afb-84b8-92ef20d6e786&tw_document_href=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o5b0k&type=javascript&version=2.3.29

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 170
date: Sun, 25 Feb 2024 21:29:15 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 9923a1f1f8bb3d88
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 298798e7f49950e69e7cf8b1aa1ee8e1b6d8353a95a107cb2d61631e821e8e58
content-length: 43

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
209 B 121ms
120ms XHR
text/plain 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1350129818&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAgEABAAAAACAEK~&jid=645250206&gjid=946004922&cid=1518872160.1708896556&tid=UA-203244293-1&_gid=393276198.1708896556&_slc=1&gtm=45He42l0n81T72STLDv849727317za200&cg1=null&cg2=resources&cd2=Pageview&cd3=1708896555867.h2gcckoo&cd4=2024-02-25T23%3A29%3A15.867%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13l3l3l3l1&dma=0&cd1=1518872160.1708896556&z=108605064

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
347 B 119ms
111ms XHR
text/plain 74.125.71.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-203244293-1&cid=1518872160.1708896556&jid=645250206&gjid=946004922&_gid=393276198.1708896556&_u=YCDAgEABAAAAAGAEK~&z=814219357

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wn-in-f157.1e100.net

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 25 Feb 2024 21:29:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.mandiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-iva...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-iva...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3460746%26time%3D1708896556302%26li_adsId%3D08b1d223-198d-4498-a35d-821dd4beb7e9%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-iva...

0
383 B

279ms
279ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&cookiesTest=true&liSync=true
Requested by: Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 16EB28D7C98946ECAE4EDF1433CCF6F8 Ref B: TLV30EDGE0516 Ref C: 2024-02-25T21:29:17Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYSO3xC1hy5doa+oU7ncw==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
date: Sun, 25 Feb 2024 21:29:16 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYSO3w+gJkvXFxx1+cQMQ==
pragma: no-cache
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 62D8AE4A2C704E3B95239F9539ACC96E Ref B: TLV30EDGE0516 Ref C: 2024-02-25T21:29:17Z
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3460746&time=1708896556302&li_adsId=08b1d223-198d-4498-a35d-821dd4beb7e9&url=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK visitWebPage
565-pei-952.mktoresp.com/webevents/ 2 B
318 B 760ms
192ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://565-pei-952.mktoresp.com/webevents/visitWebPage?_mchNc=1708896556365&_mchCn=&_mchId=565-PEI-952&_mchTk=_mch-mandiant.com-1708896556364-83075&_mchHo=www.mandiant.com&_mchPo=&_mchRu=%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date: Sun, 25 Feb 2024 21:29:17 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: d1079e2a-39e5-4908-a89a-211b738ba9b2

GET
H2 200 880805232811859 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 227ms
226ms Script
application/x-javascript 157.240.253.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/880805232811859?v=2.9.147&r=stable&domain=www.mandiant.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-fra5.fbcdn.net

Software

Resource Hash

bc3822b1b5b7439e7df19dbe92b28ad4d9901014ef8dcf5c314f2437dfa43c81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 25 Feb 2024 21:29:16 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: j9DDkDuQZvRvK9UhTTm/nlRnYAx92++DlbBlf0B3qW0Ux886lihOah+IdzZGmGLMximuSre5S5Fa/Cb1IuP12A==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 Barlow-Bold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
56 KB 523ms
523ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Bold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 20
date: Sun, 25 Feb 2024 21:29:17 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 57572
x-request-id: v-f7548f6e-d2f7-11ee-b30a-377dcb232faf
last-modified: Wed, 26 Oct 2022 20:37:18 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af6a9ff9241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H2 200 Barlow-SemiBold.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 56 KB
57 KB 512ms
511ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-SemiBold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 3549
date: Sun, 25 Feb 2024 21:29:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 57764
x-request-id: v-e6740d5a-d22f-11ee-ab21-c358197b445d
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af6aa029241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H2 200 Barlow-Medium.woff2
www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/ 55 KB
55 KB 507ms
507ms Font
text/plain 162.159.241.125
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.mandiant.com/themes/custom/mandiant_theme/gnorm/build/fonts/barlow/Barlow-Medium.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.241.125 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.mandiant.com/sites/default/files/css/css_Yw6OVXvPezay5yis2fK3Ww_gPGJFkqY8-dShIrZV6nI.css?delta=1&language=en&theme=mandiant_theme&include=eJxtUNFuwzAI_CG3fJJFMEm92CYC0sh_P69du0rZCzoOuDsxi1bPm8H8CwKm5IKtwwtcZ5XmgXZzqbFyygifTSSzYN2cK0xoHCq2QTePfuPKsLQhfTHvhe3_2deJv7N6JiwXx8kCrcPHRSMSiaYsDd7omY5b-pNQJtycbghvFPPYWRR9XHx4HYyrQUVd2SX-vOA03FQWZbM4oYaCXXaPKRvJiNhBGpOUFz_tuSRW8EMGG43p4XfPfBg86rVK2gufXJZ8jnVk5Vmx8je6jqaq
Origin: https://www.mandiant.com
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-cache-hits: 2530
date: Sun, 25 Feb 2024 21:29:16 GMT
via: varnish
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-cache: HIT
x-ah-environment: prod
content-length: 55968
x-request-id: v-e68d9f54-d22f-11ee-b5d0-879693a1342d
last-modified: Wed, 26 Oct 2022 20:16:57 GMT
server: cloudflare
vary: Accept-Encoding
cache-control: public, max-age=1209600
accept-ranges: bytes
cf-ray: 85b30af6aa039241-FRA
expires: Sun, 10 Mar 2024 21:29:16 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 320ms
105ms Image
text/plain 157.240.253.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=880805232811859&ev=PageView&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&rl=&if=false&ts=1708896556621&sw=1600&sh=1200&v=2.9.147&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4125&fbp=fb.1.1708896556620.1645096903&ler=empty&cdl=API_unavailable&it=1708896556380&coo=false&tm=1&exp=e1&rqm=GET

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.253.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-fra5.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 25 Feb 2024 21:29:16 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 browser-perf.8417c6bba72228fa2e29.js Show response
script.hotjar.com/ 5 KB
2 KB 109ms
108ms Script
application/javascript 13.32.27.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js

Requested by

Host: script.hotjar.com
URL: https://script.hotjar.com/modules.3ba69200791f16077ba8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.54 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-54.fra56.r.cloudfront.net

Software

Resource Hash

70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 14:32:07 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 07fbd2276304c86925071791c7032950.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 2789829
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 1782
last-modified: Wed, 24 Jan 2024 14:31:37 GMT
etag: "b83b61bc5871e9a23a0434e2c539f4f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: bG1NLtR5YhdbKyWuyK-e-y4rQx4uQ7WhxjqoADc9dL4oake9DwNgoA==

GET
H2 200 i Show response
scout.salesloft.com/ 48 B
466 B 190ms
190ms XHR
application/json 52.71.29.144
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://scout.salesloft.com/i

Requested by

Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.71.29.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-71-29-144.compute-1.amazonaws.com

Software

Resource Hash

0c5ff68d4db607fc177ee258f1c758ccedb104e66cf8e7fa913d79b63b4fda9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.mandiant.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 48
x-request-id: 88daca0cf344e3835c52057962a41afc

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
198 B 281ms
281ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.mandiant.com/
accept-language: he-IL,he;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 25 Feb 2024 21:29:16 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 36970FB9AB1F47C29FD1A32A3AB1FFEB Ref B: TLV30EDGE0516 Ref C: 2024-02-25T21:29:17Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://www.mandiant.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYSO3xHLixTQ5J2TisGdw==

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
18 KB 347ms
113ms Script
application/javascript 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.mandiant.com
URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Feb 2024 19:00:41 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65d799d9-101dd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17693
expires: Sun, 25 Feb 2024 21:29:17 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 110ms
110ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1350129818&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Resource%20Type&ea=null&el=null&_u=aCDAgEABAAAAAGAEK~&jid=&gjid=&cid=1518872160.1708896556&tid=UA-203244293-1&_gid=393276198.1708896556&gtm=45He42l0n81T72STLDv849727317za200&cg1=null&cg2=resources&cd3=1708896557548.cv0kkk8d&cd4=2024-02-25T23%3A29%3A17.548%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13l3l3l3l1&dma=0&cd1=1518872160.1708896556&z=1456580079

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 07:49:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49184
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 110ms
110ms Image
image/gif 172.217.18.14
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=1350129818&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&ul=en-us&de=UTF-8&dt=404%20page%20%7C%20Mandiant&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=page%20scroll&ea=25%25&el=%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&_u=aCDAgEABAAAAAGAEK~&jid=&gjid=&cid=1518872160.1708896556&tid=UA-203244293-1&_gid=393276198.1708896556&gtm=45He42l0n81T72STLDv849727317za200&cg1=null&cg2=resources&cd2=Event&cd3=1708896557560.quvtor87&cd4=2024-02-25T23%3A29%3A17.560%2B02%3A00&cd5=&cd15=null&cd16=null&cd24=unknown&gcd=13l3l3l3l1&dma=0&cd1=1518872160.1708896556&z=1509054706

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 07:49:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49184
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 116ms
115ms XHR
text/html 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-19-120-10.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:18 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
284 B 364ms
130ms XHR
text/html 23.38.98.119
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.98.119 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-38-98-119.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 21:29:18 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.mandiant.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: null
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1708896558161_388391863_1866751618_20_929_56_120_219";dur=1
content-length: 4
expires: Sun, 25 Feb 2024 21:29:18 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 295ms
294ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:18 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 285ms
285ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22627b22264f359a2be8e661bd05849ae6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:18 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 5438 46 KB
29 KB 134ms
134ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=bb62aat6qqgg

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

7ec533201c36e31a6e121d7300fa51d3621b940dc7a74e30591298267cff82b7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_kOVuEy1BWREvegeJMpnxw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-_kOVuEy1BWREvegeJMpnxw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Feb 2024 21:29:18 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 8BCB 48 KB
30 KB 196ms
196ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=compact&cb=lqhc0wy8jett

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

2b1705cd8222435e0696d1dde914510eeec55e7a2a526ee8d6dac31d4c2e13c6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0r1RB6vzPtuh1PFns41JGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-0r1RB6vzPtuh1PFns41JGA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Feb 2024 21:29:18 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 5438 55 KB
24 KB 111ms
111ms Stylesheet
text/css 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=bb62aat6qqgg

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 5438 518 KB
198 KB 162ms
162ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 00:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421680
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Feb 2025 00:21:18 GMT

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 8BCB 55 KB
24 KB 110ms
110ms Stylesheet
text/css 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 8BCB 518 KB
198 KB 219ms
219ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 00:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421680
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Feb 2025 00:21:18 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 286ms
286ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A17%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:19 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 ASXaQ1z0KI3ZfklOIfMB5uxT7QXe_3xy1EhxeYl1sZs.js Show response
www.google.com/js/bg/ Frame 5438 17 KB
7 KB 113ms
113ms Script
text/javascript 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/ASXaQ1z0KI3ZfklOIfMB5uxT7QXe_3xy1EhxeYl1sZs.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

sffe /

Resource Hash

0125da435cf4288dd97e494e21f301e6ec53ed05deff7c72d44871798975b19b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=bb62aat6qqgg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 15:01:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 196071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6956
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 15:01:28 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 5438 102 B
135 B 122ms
122ms Other
text/javascript 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

15968c31de4feede3cef1e6d6f6d22cdf0e3357c787b8c33a9385680aa5e83d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=normal&cb=bb62aat6qqgg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 25 Feb 2024 21:29:19 GMT

GET
H3 200 ASXaQ1z0KI3ZfklOIfMB5uxT7QXe_3xy1EhxeYl1sZs.js Show response
www.google.com/js/bg/ Frame 8BCB 17 KB
7 KB 114ms
113ms Script
text/javascript 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/ASXaQ1z0KI3ZfklOIfMB5uxT7QXe_3xy1EhxeYl1sZs.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

sffe /

Resource Hash

0125da435cf4288dd97e494e21f301e6ec53ed05deff7c72d44871798975b19b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=compact&cb=lqhc0wy8jett
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 15:01:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 196071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6956
x-xss-protection: 0
last-modified: Mon, 12 Feb 2024 13:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 15:01:28 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 8BCB 102 B
135 B 127ms
127ms Other
text/javascript 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

15968c31de4feede3cef1e6d6f6d22cdf0e3357c787b8c33a9385680aa5e83d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq&co=aHR0cHM6Ly93d3cubWFuZGlhbnQuY29tOjQ0Mw..&hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&size=compact&cb=lqhc0wy8jett
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Sun, 25 Feb 2024 21:29:19 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 863F 7 KB
1 KB 133ms
132ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

7c8cb5ab738dc8b4e32c28c334c3768cfa14b8140d0c1e0fc05c0248ba904777

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PoRoap3vaSUju2VTsjeUvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-PoRoap3vaSUju2VTsjeUvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Feb 2024 21:29:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 094A 7 KB
1 KB 125ms
124ms Document
text/html 142.250.186.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f4.1e100.net

Software

GSE /

Resource Hash

e2354f2e0f851a9b5240690a6728b25e15028e7fc3702a273b99197197f83fcd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZKaXn8l6nRNkrdTT-TwA2Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.mandiant.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: he-IL,he;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ZKaXn8l6nRNkrdTT-TwA2Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 25 Feb 2024 21:29:19 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 863F 55 KB
24 KB 111ms
110ms Stylesheet
text/css 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209041
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 863F 518 KB
198 KB 115ms
114ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 00:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421681
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Feb 2025 00:21:18 GMT

GET
H3 200 styles__rtl.css
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 094A 55 KB
24 KB 112ms
111ms Stylesheet
text/css 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/styles__rtl.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 11:25:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 209041
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24601
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 11:25:18 GMT

GET
H3 200 recaptcha__iw.js Show response
www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/ Frame 094A 518 KB
198 KB 120ms
120ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/1kRDYC3bfA-o6-tsWzIBvp7k/recaptcha__iw.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=iw&v=1kRDYC3bfA-o6-tsWzIBvp7k&k=6LdhgBgUAAAAAILakhHCM8iL5pygGB4jLnJbJFfq

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Wed, 21 Feb 2024 00:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421681
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203025
x-xss-protection: 0
last-modified: Mon, 19 Feb 2024 05:01:55 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Feb 2025 00:21:18 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 304ms
304ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:20 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 294ms
293ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A19%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:21 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
483 B 295ms
295ms Image
image/gif 2.19.120.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=627b22264f359a2be8e661bd05849ae6&svisitor=null&visitor=bd5caac6-3942-4635-80ee-e4cd7c86782a&session=a102a591-be06-4b96-8463-9d696a09cef8&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2025%20Feb%202024%2021%3A29%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22404%20page%20%7C%20Mandiant%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&pageViewId=6f78fd89-f6ef-474d-8569-9ec8484306a6&v=1.1.15

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.120.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-19-120-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: he-IL,he;q=0.9
Referer: https://www.mandiant.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 21:29:22 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST collect
analytics.google.com/g/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: analytics.google.com
URL: https://analytics.google.com/g/collect?v=2&tid=G-X6642ZTDJ7&gtm=45je42l0v883779794z8849727317za220&_p=1708896555308&gcd=13l3l3l3l1&npa=0&dma=0&cid=1518872160.1708896556&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EA&_s=2&sid=1708896556&sct=1&seg=0&dl=https%3A%2F%2Fwww.mandiant.com%2Fresources%2Fblog%2Finvestigating-ivanti-zero-dayexploitation&dt=404%20page%20%7C%20Mandiant&en=resource_view&ep.resource_type=null&ep.resource_date=null&ep.resource_title=null&ep.resource_topic=null&ep.resource_author=null&_et=1473&tfd=9076

Verdicts & Comments Add Verdict or Comment

79 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

27 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mandiant.com/	1970-01-20 18:41:38	Name: __cf_bm Value: 6kzc0sQylQXClyEa0M2EW7Rl6Ud92SkqXnWZW.F1AEY-1708896554-1.0-AR7JvgoTxvX4tdpuX/Saqo1CDtMlRKDTc25uKXr7Qsn6q3w6Q/DR2SN5STV9XucYDXY0VauTb1wkI2W6FcHc+Y0=
.mandiant.com/	1970-01-20 20:51:12	Name: _gcl_au Value: 1.1.1644749207.1708896556
.mandiant.com/	1970-01-20 18:43:02	Name: _uetsid Value: ed6db5f0d42411eebe3b1b1c408ecb70
.mandiant.com/	1970-01-21 04:03:12	Name: _uetvid Value: ed6db660d42411eeb91c35a82d5c1f37
.mandiant.com/	1970-01-21 04:17:36	Name: _ga Value: GA1.2.1518872160.1708896556
.mandiant.com/	1970-01-20 18:43:02	Name: _gid Value: GA1.2.393276198.1708896556
.mandiant.com/	1970-01-20 18:41:36	Name: _dc_gtm_UA-203244293-1 Value: 1
.mandiant.com/	1970-01-21 04:17:36	Name: _mkto_trk Value: id:565-PEI-952&token:_mch-mandiant.com-1708896556364-83075
.bing.com/	1970-01-21 04:03:12	Name: MUID Value: 046B87DFC9616C1637F693EFC8F16D31
.mandiant.com/	1970-01-20 20:51:12	Name: _fbp Value: fb.1.1708896556620.1645096903
.linkedin.com/	1970-01-20 20:51:12	Name: li_sugr Value: 7d2d9ac1-cb61-4212-9724-1ed7c1e021ff
.linkedin.com/	1970-01-21 03:27:12	Name: bcookie Value: "v=2&d009f2f5-5a7b-406f-8087-522c035af584"
.linkedin.com/	1970-01-20 18:43:02	Name: lidc Value: "b=OGST01:s=O:r=O:a=O:p=O:g=3190:u=1:x=1:i=1708896556:t=1708982956:v=2:sig=AQHDyb1eww8jHNuXFJC8xBj7yFNgdiPg"
.t.co/	1970-01-21 04:17:36	Name: muc_ads Value: 86c34da3-5b23-4dc3-b3a4-f33e0f20940b
.mandiant.com/	1970-01-21 03:27:12	Name: _hjSessionUser_3008912 Value: eyJpZCI6IjVjYTM4ODVlLThkZmYtNWU1MS1iYzk1LTc4MzIwNDVjOWQxZSIsImNyZWF0ZWQiOjE3MDg4OTY1NTY3NDUsImV4aXN0aW5nIjpmYWxzZX0=
.mandiant.com/	1970-01-20 18:41:38	Name: _hjSession_3008912 Value: eyJpZCI6ImQ5NTI3MTQ3LTdmZmYtNDEwMy1iODVjLTQxMjA1NGM0N2Q0YyIsImMiOjE3MDg4OTY1NTY3NDYsInMiOjAsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
www.mandiant.com/	1970-01-20 18:51:41	Name: slireg Value: https://scout.us3.salesloft.com
.twitter.com/	1970-01-21 04:17:36	Name: personalization_id Value: "v1_ERzxxjKHIhZqTXL55AIE/A=="
www.mandiant.com/	1970-01-21 03:27:12	Name: sliguid Value: efbc7e9f-69ef-4f6d-9f68-75601ecd8d93
www.mandiant.com/	1970-01-21 03:27:12	Name: slirequested Value: true
.linkedin.com/	1970-01-20 19:24:48	Name: UserMatchHistory Value: AQJxBmNJbG_PCAAAAY3iLBcf_1NyNLPEdoKI_9MD7TDZZiy5CIpZWXe3N-vB8V1L6f6MAZd5UxZ_pg
.linkedin.com/	1970-01-20 19:24:48	Name: AnalyticsSyncHistory Value: AQJfFe65rnHPXAAAAY3iLBcfR8q-UovUWKlTb7rVCVH1e6YXgLGzJxTN8p-7y1zhKyUymLtFV4iQwh6ibmi0Rg
.www.linkedin.com/	1970-01-21 03:27:12	Name: bscookie Value: "v=1&20240225212917967c4536-4bcc-4221-8e36-f6a8c0c6ef69AQEDxq_N0SpiUkWA0OEvyCo1gq3bcL6j"
.mandiant.com/	1970-01-21 04:17:36	Name: _ga_X6642ZTDJ7 Value: GS1.1.1708896556.1.0.1708896557.59.0.0
www.mandiant.com/	1970-01-21 04:17:36	Name: _gd_visitor Value: bd5caac6-3942-4635-80ee-e4cd7c86782a
www.mandiant.com/	1970-01-20 18:41:50	Name: _gd_session Value: a102a591-be06-4b96-8463-9d696a09cef8
.6sc.co/	1970-01-21 04:17:36	Name: 6suuid Value: 0a771302398801002eb1db65e0000000f061c100

43 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/880805232811859?v=2.9.147&r=stable&domain=www.mandiant.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.mandiant.com/resources/blog/investigating-ivanti-zero-dayexploitation Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	report-uri /report-csp-violation
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

565-pei-952.mktoresp.com
analytics.google.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn4.iconfinder.com
cdnjs.cloudflare.com
connect.facebook.net
fonts.googleapis.com
ipv6.6sc.co
j.6sc.co
munchkin.marketo.net
px.ads.linkedin.com
scout-cdn.salesloft.com
scout.salesloft.com
script.hotjar.com
snap.licdn.com
static.addtoany.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.co.il
www.google.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
www.mandiant.com
analytics.google.com
104.17.24.14
104.17.67.65
104.244.42.195
104.244.42.5
13.107.42.14
13.32.27.54
142.250.185.163
142.250.186.104
142.250.186.164
142.250.186.67
146.75.120.157
157.240.253.1
157.240.253.35
162.159.240.125
162.159.241.125
172.217.18.106
172.217.18.14
172.66.41.45
172.67.39.148
184.31.85.59
192.28.144.124
2.18.64.220
2.19.120.10
204.79.197.200
216.239.36.181
23.38.98.119
3.162.38.9
52.71.29.144
74.125.71.157
0125da435cf4288dd97e494e21f301e6ec53ed05deff7c72d44871798975b19b
0b617a1a9d405a304eae1f3337639a1be619633a047ccac0a61d70cf2d2032e4
0c5ff68d4db607fc177ee258f1c758ccedb104e66cf8e7fa913d79b63b4fda9d
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
0f2e61cd1a10aebb0eae1a2f6914784a4d9be90a46b1c67700311d0f66d3e379
15968c31de4feede3cef1e6d6f6d22cdf0e3357c787b8c33a9385680aa5e83d7
1916ec439c6efb5e417e64c3b2db0f06a16b6308972312f0060b202356fcfad8
1bb508d41bf1d0c5d56340c7df789b6589350a5f967e1fa937bee5c148d0cb0d
1cfea949b0b2925d27b84d56d18f2ea1c6b948fdf3ae95c534a14706043da178
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
201492c149f68b701455a2d046549a318a76ed5bca4ab13ebd913dbd14710246
219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0
274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad
2b1705cd8222435e0696d1dde914510eeec55e7a2a526ee8d6dac31d4c2e13c6
3245f6cb8d40eebea048a60b056d9a48cbc3e1b0309a0a4cb0e51280f6b0c712
45396b8359112c614d4aab3fcb716deaabc47e477078f675d7bf69f5791c8f53
4a007af67f716c30c8848ab0ad0bfaab8a5fcf3e36dedf918b59c9429d522440
4fa7ca84dc3a040c7199206d3554b4b57d6cbb5c49ef435f674103587640d26a
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
591ec898579fc34d46d85f9b22fa8fcfa88465454caa0d86d03e9e6dc0675f9b
59baae98dcb18f9f30f94f260fa83ed455233d33cc6b5900b4210560337cd09c
5f206b060caf20ae38c428c1bad44ccaf68b6345b63f2a7f06428e9747526c06
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6b9c3158d7700a96a2fc4de59adc0c4724338c900d14b9447653c52d50df1621
6cdc249fe2d6f4d8e895f3033d11e4b917dcfa03ef5447665ba53b92192a59f4
70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
74397437d41d0ef91b6ac1cbd4edb0c5fb809cd9299cccf6adde7b5b8937e79f
7762b4265e6050c33745fd1fae5110f9f265564f0a85d9ac01efaa65029db59c
7c8cb5ab738dc8b4e32c28c334c3768cfa14b8140d0c1e0fc05c0248ba904777
7ec533201c36e31a6e121d7300fa51d3621b940dc7a74e30591298267cff82b7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a2c8237ce87e24ac94b20ff21c0fbd9459864892a5940921c6def6b6d1343a9
8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df
8a7b82ca2e7779906e5ed103e6aea92ad41856bf2265ac009947b59b0d752f06
8c1781ec4483c6fb3bd9ad005d312800eaf24e232c12976624bff84f8ab908b3
9ec192b1be13b5eb7d11e7c8a0f1466ef236e4ba88182bb4cec76a2c7919464e
a0a1f98fca203b8561519a06bacfdc50e4b3c4a5a71e740da5b0875bd4fc00d6
a8c0404cf93d4893ffa5fd999919ab905334a31b9e4ae0631eb8c3512b868308
a9b7a66985bebc105b4b12f2f466fae88b9b16fe17ea5bc1d515753258a0be19
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b2cb383a30bee467e40ecebb49e4229b1b57efcc2c7632c921cd170a75c74d24
bc3822b1b5b7439e7df19dbe92b28ad4d9901014ef8dcf5c314f2437dfa43c81
c60a1c9a37989557aed8884899ddec28096d9624f4b43c602f9b335ae1db25cf
cde0ec44099aedd320856a4c527ba897b63e1a4915f7e4e00b63d9a35df77f88
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d8885f82460cd5977ef2f391c02cad23cd0262b3d9ec42c4aa92a1ecad0bf461
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfaed587b938cc953c5008f257ed1e661e9d2e2f907bd5b520fc4b9348985a88
e1cd8e9c3c0e2ec3111f46d6ba125fe1726b7933055503563d7d88ec48089ea8
e2354f2e0f851a9b5240690a6728b25e15028e7fc3702a273b99197197f83fcd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5724b80dd7456460f12db0a8870676b40184fa7076eb751afb23be11164719c
e9474894bf64b11c40884f83b0ba6888635bf90bfaae11db1944d99771f1c820
e9841d9258210b13f0870a80d02ce8f3224c8798d1c0d618f210a573ce96038e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f269cafacd48c650b7c76973b7192a4593125d9b957bfa3b57a89e835ec0df1f
f3212d7385c327317abf55280e4e949368eeda26977bbed7761a5a22fc2e2202
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe3bfdac05de97234a1a81c7f09c87f14708cf7bd9a341a63e68613c3c6e40d6

www.mandiant.com Open in urlscan Pro 162.159.241.125 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

87 Requests

98 %HTTPS

0 %IPv6

24 Domains

31 Subdomains

29 IPs

3 Countries

2561 kBTransfer

6567 kBSize

27 Cookies

16 Outgoing links

Page URL History

Redirected requests

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.mandiant.com Open in urlscan Pro
162.159.241.125 Public Scan

Screenshot
Live screenshot

Full Image

87
Requests

98 %
HTTPS

0 %
IPv6

24
Domains

31
Subdomains

29
IPs

3
Countries

2561 kB
Transfer

6567 kB
Size

27
Cookies

87 HTTP transactions
0 data transactions