www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
Effective URL:
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Submission: On September 28 via api (September 28th 2020, 10:57:52 pm UTC) from US

Summary HTTP 99 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 37 IPs in 7 countries across 33 domains to perform 99 HTTP transactions. The main IP is 13.56.33.144, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	96.45.36.159 96.45.36.159	40934 (FORTINET) (FORTINET)
1 23	13.56.33.144 13.56.33.144	16509 (AMAZON-02) (AMAZON-02)
9	2a02:26f0:6c0... 2a02:26f0:6c00:299::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	3.248.30.231 3.248.30.231	16509 (AMAZON-02) (AMAZON-02)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.49.59.93 52.49.59.93	16509 (AMAZON-02) (AMAZON-02)
2	15.236.9.100 15.236.9.100	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	147.75.102.197 147.75.102.197	54825 (PACKET) (PACKET)
1	23.111.11.182 23.111.11.182	33438 (HIGHWINDS2) (HIGHWINDS2)
1	147.75.33.131 147.75.33.131	54825 (PACKET) (PACKET)
2	99.86.243.128 99.86.243.128	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE)
1	147.75.84.91 147.75.84.91	54825 (PACKET) (PACKET)
2	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
2	35.174.150.168 35.174.150.168	14618 (AMAZON-AES) (AMAZON-AES)
1	63.32.141.164 63.32.141.164	16509 (AMAZON-02) (AMAZON-02)
1	147.75.100.245 147.75.100.245	54825 (PACKET) (PACKET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	54.77.58.217 54.77.58.217	16509 (AMAZON-02) (AMAZON-02)
1	172.217.21.226 172.217.21.226	15169 (GOOGLE) (GOOGLE)
1 5	2.18.233.40 2.18.233.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
4	2a00:1450:400... 2a00:1450:4001:824::2002	15169 (GOOGLE) (GOOGLE)
1 1	34.253.167.156 34.253.167.156	16509 (AMAZON-02) (AMAZON-02)
1	52.215.248.90 52.215.248.90	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
2 2	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
2 2	34.246.29.23 34.246.29.23	16509 (AMAZON-02) (AMAZON-02)
2 2	52.211.146.59 52.211.146.59	16509 (AMAZON-02) (AMAZON-02)
1 2	3.121.27.153 3.121.27.153	16509 (AMAZON-02) (AMAZON-02)
1	23.111.11.71 23.111.11.71	33438 (HIGHWINDS2) (HIGHWINDS2)
1	35.153.56.97 35.153.56.97	14618 (AMAZON-AES) (AMAZON-AES)
1	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
99	37

3 96.45.36.159 (San Jose, United States) 2 redirects

ASN40934 (FORTINET, US)

blog.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
site.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 13.56.33.144 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-33-144.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:6c00:299::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.248.30.231 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-30-231.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.49.59.93 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-59-93.eu-west-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.9.100 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.197 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress11

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.33.131 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress9

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.243.128 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-128.vie50.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.91 (Parsippany, United States)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress13

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.150.168 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-3-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.32.141.164 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-141-164.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.100.245 (Central, Hong Kong)

ASN54825 (PACKET, US)
PTR: pkt-ams-k2-shared-ingress2

vc.hotjar.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.77.58.217 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.21.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s13-in-f226.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.18.233.40 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-233-40.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:824::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.167.156 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-167-156.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.215.248.90 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-248-90.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.207.148 (United States) 2 redirects

ASN15169 (GOOGLE, US)

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.246.29.23 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.211.146.59 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.121.27.153 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-27-153.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.71 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.153.56.97 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-153-56-97.compute-1.amazonaws.com

nextroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.174.151.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-4-ue1.aws.pardot.com

go.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	fortinet.com 3 redirects blog.fortinet.com www.fortinet.com metrics.fortinet.com site.fortinet.com go.fortinet.com	616 KB
9	adobedtm.com assets.adobedtm.com	78 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	68 KB
6	ml314.com 1 redirects ml314.com	15 KB
5	googletagmanager.com www.googletagmanager.com	179 KB
5	demdex.net 1 redirects dpm.demdex.net fortinet.demdex.net	4 KB
4	google.de www.google.de	881 B
4	google.com www.google.com	1 KB
4	doubleclick.net googleads.g.doubleclick.net	6 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	73 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	omappapi.com api.omappapi.com a.omappapi.com	24 KB
2	eyeota.net 1 redirects ps.eyeota.net	1023 B
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1003 B
2	adsrvr.org 2 redirects match.adsrvr.org	928 B
2	rlcdn.com 2 redirects idsync.rlcdn.com	802 B
2	facebook.com www.facebook.com	483 B
2	licdn.com snap.licdn.com	3 KB
2	facebook.net connect.facebook.net	166 KB
2	pardot.com pi.pardot.com	4 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	nextroll.com nextroll.com	2 KB
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	138 B
1	t.co t.co	448 B
1	twitter.com analytics.twitter.com	651 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	hotjar.io vc.hotjar.io	116 B
1	addthisedge.com v1.addthisedge.com	756 B
1	opmnstr.com a.opmnstr.com	62 KB
1	moatads.com z.moatads.com	1 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
99	33

	Domain	Requested by
23	www.fortinet.com	1 redirects www.fortinet.com
9	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
6	ml314.com	1 redirects www.fortinet.com ml314.com
5	s.adroll.com	1 redirects www.fortinet.com s.adroll.com
5	www.googletagmanager.com	www.fortinet.com www.googletagmanager.com assets.adobedtm.com
4	www.google.de
4	www.google.com
4	googleads.g.doubleclick.net	www.googleadservices.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	s7.addthis.com	assets.adobedtm.com s7.addthis.com
2	ps.eyeota.net	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	match.adsrvr.org	2 redirects
2	idsync.rlcdn.com	2 redirects
2	www.facebook.com	connect.facebook.net
2	px.ads.linkedin.com	1 redirects
2	snap.licdn.com	www.fortinet.com snap.licdn.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	pi.pardot.com	www.fortinet.com pi.pardot.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	api.omappapi.com	a.opmnstr.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
2	blog.fortinet.com	2 redirects
1	go.fortinet.com	pi.pardot.com
1	nextroll.com
1	a.omappapi.com	a.opmnstr.com
1	d.adroll.com
1	d.adroll.mgr.consensu.org	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.fortinet.com
1	vc.hotjar.io	script.hotjar.com
1	in.hotjar.com	script.hotjar.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	site.fortinet.com	www.fortinet.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	a.opmnstr.com	assets.adobedtm.com
1	static.hotjar.com	www.fortinet.com
1	z.moatads.com	s7.addthis.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
99	45

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
static.hotjar.com Let's Encrypt Authority X3	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
script.hotjar.com Let's Encrypt Authority X3	`2020-08-17` - `2020-11-15`	3 months	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
vars.hotjar.com Let's Encrypt Authority X3	`2020-08-15` - `2020-11-13`	3 months	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.hotjar.com Amazon	`2020-08-29` - `2021-09-28`	a year	crt.sh
vc.hotjar.io Let's Encrypt Authority X3	`2020-09-12` - `2020-12-11`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.ml314.com Amazon	`2020-02-17` - `2021-03-17`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
*.omappapi.com Go Daddy Secure Certificate Authority - G2	`2020-03-16` - `2022-03-16`	2 years	crt.sh
nextroll.com Let's Encrypt Authority X3	`2020-09-20` - `2020-12-19`	3 months	crt.sh
go.fortinet.com Let's Encrypt Authority X3	`2020-09-25` - `2020-12-24`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Frame ID: 3C31B312986CBB151A4E869216E79071
Requests: 97 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 8DDB7725C99C434C02DE2501BDAEB60E
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: A40819628881EC2C22EFB608B7C3E9F2
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 360DB524A25B99A78933DCD353DBE984
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 100F69CF530183FC6C7D8F53CBD837AF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1 Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

99
Requests

99 %
HTTPS

26 %
IPv6

33
Domains

45
Subdomains

37
IPs

7
Countries

1525 kB
Transfer

4300 kB
Size

17
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse Community

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 HTTP 301
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279

Request Chain 25

https://cm.everesttech.net/cm/dd?d_uuid=13987652968919378753093207183746531983 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3JqYAAAB0_IbBTJ

Request Chain 66

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1601333856732%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fdeep-analysis-of-new-emotet-variant-part-1%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true

Request Chain 74

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 76

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=64e3417413d5838f12a464d73b3b9658&_b=2 HTTP 302
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=64e3417413d5838f12a464d73b3b9658&_b=2

Request Chain 88

https://idsync.rlcdn.com/395886.gif?partner_uid=3613454624348962863 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxMzQ1NDYyNDM0ODk2Mjg2MxAAGg0I4NTJ-wUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=76aea8112161a796612b4f1b1066020a474c41cb3e4eecafd96bce64da0dfe05f4cb09cee1a4f8eb&person_id=3613454624348962863&eid=50082

Request Chain 89

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba HTTP 302
https://ml314.com/csync.ashx?fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba&person_id=3613454624348962863&eid=53819

Request Chain 90

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3613454624348962863 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3613454624348962863 HTTP 302
https://ml314.com/csync.ashx?fp=bda8d7322a9a5a5cae5e1d8d85cbd7a8&eid=50146&person_id=3613454624348962863

Request Chain 91

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

99 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request deep-analysis-of-new-emotet-variant-part-1 Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://www.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1
https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

39 KB
14 KB

163ms
163ms

Document
text/html

13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d9975b62cb26a9dae9b2b0878ab302c37aec37c6f6b6fe2620d184cd7b8b76bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: cookiesession1=47695768HN18CQDOBP1IRXY0Q0VNF950
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Mon, 28 Sep 2020 22:57:35 GMT
ETag: "9be7-5b061daa55dbe-gzip"
Last-Modified: Mon, 28 Sep 2020 16:06:50 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher2uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 13605
Connection: keep-alive

Redirect headers

Content-Type: text/html; charset=iso-8859-1
Date: Mon, 28 Sep 2020 22:57:34 GMT
Location: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Dispatcher: dispatcher1uswest1
X-Vhost: publish
Content-Length: 296
Connection: keep-alive
Set-Cookie: cookiesession1=47695768HN18CQDOBP1IRXY0Q0VNF950;Path=/;HttpOnly

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 217 KB
27 KB 304ms
167ms Stylesheet
text/css 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 27147
Last-Modified: Wed, 09 Sep 2020 21:03:28 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "36377-5aee7c87f0800-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 245 KB
59 KB 28ms
12ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0b15b4377a9bb3c650e14f104ff2a36eee7aa8c566f75c819e58c0bce00b36a5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:35 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:00 GMT
server: AkamaiNetStorage
status: 200
etag: "38cce97d3dc551e733a62156a762d095:1601332140.549144"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 28 Sep 2020 23:57:35 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 618ms
159ms Image
image/svg+xml 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1131.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 11 KB
12 KB 622ms
162ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1131.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

2769ca5ab6b82d7e78029c047d2ad2c9509473541a3ddae53f3a07086a98c0a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:28:36 GMT
Server: Apache
ETag: "2de4-56f2d99142900"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 11748

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1132.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 24 KB
24 KB 644ms
166ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1132.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

9a79bdb5e88745d369e9a9916cf8ee11d6df45f02c5afff20a75386b1e99c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:34:54 GMT
Server: Apache
ETag: "5e4b-56f2daf9bfb80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 24139

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1133.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 3 KB
3 KB 643ms
164ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1133.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

0d32e1fbdf765264e5622fce18c8dff32ed318619d4d1b36cadb95d5d8ce8948

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:36:04 GMT
Server: Apache
ETag: "acd-56f2db3c81900"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 2765

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1134.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 7 KB
7 KB 612ms
165ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1134.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c365e3170a06fdf90a7abceab2abf62c8aa658a870e7310d9041f6550cadd467

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:30:23 GMT
Server: Apache
ETag: "1a47-56f2d9f74d9c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 6727

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1135.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 12 KB
12 KB 162ms
162ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1135.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d73dc6d4597be4d66d2dbf8cd51e03251507a849c35bb5a1f97f0651fb438b91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:23:57 GMT
Server: Apache
ETag: "2fc8-56f2d8872f540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 12232

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1136.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 30 KB
31 KB 161ms
161ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1136.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ab56721300f018e546467bf273f8ddef14a3de34f96a7b46dec36c86cd16b0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:26:55 GMT
Server: Apache
ETag: "7927-56f2d930f05c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 31015

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1137.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 4 KB
4 KB 162ms
162ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1137.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

134597068595db606c339a0d5984297c453da7bd2d7888b4a8d59a912cf9a1e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:35:28 GMT
Server: Apache
ETag: "fdc-56f2db1a2c800"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 4060

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1138.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 20 KB
20 KB 156ms
155ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1138.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

f1a68763b703a2efc6d778b7c89565f48882d3e667051006420b4b1537e9a9a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:30:04 GMT
Server: Apache
ETag: "4f6a-56f2d9e52ef00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 20330

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1139.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 18 KB
18 KB 161ms
160ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1139.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

33379cd3124278877df5e3776a342e8282fb7bfd33edbdd131a1d80aec2dc6be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:27:54 GMT
Server: Apache
ETag: "4812-56f2d96934a80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 18450

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1140.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 16 KB
16 KB 162ms
162ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1140.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

797ac4f126723e434e5b1f5f857ce1d21fa34370030b679e21df00df3279ce19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:37:27 GMT
Server: Apache
ETag: "3e34-56f2db8ba93c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 15924

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1141.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 17 KB
17 KB 163ms
161ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1141.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

929d840a255355f0ef708b4ec54d37ab16392b8176a330dc97e0a2d34cfa8054

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:31:07 GMT
Server: Apache
ETag: "4264-56f2da2143cc0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 16996

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1142.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 6 KB
6 KB 155ms
155ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1142.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

05ea6f9aabf5fcf07b9a7724bc0ef9c4fa8d811b5df669112ae9124443a472aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:23:57 GMT
Server: Apache
ETag: "165c-56f2d8872f540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 5724

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1143.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 18 KB
18 KB 161ms
160ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1143.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

5cac00caee3e442510cda0c641976c0a5245acdbb7d6d853d74f3740b39f4b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:26:58 GMT
Server: Apache
ETag: "4687-56f2d933ccc80"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 18055

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-1-1144.png
www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/ 37 KB
38 KB 162ms
161ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/new-images/uploads/deep-analysis-of-new-emotet-variant-part-1-1144.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a579d3a189415086da085a6953df6f2929cc7cff093c6e83ee6d5f026b1d0505

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 21 Jun 2018 21:36:07 GMT
Server: Apache
ETag: "959b-56f2db3f5dfc0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 38299

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279

367 B
1 KB

35ms
34ms

XHR
application/json

3.248.30.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.30.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-30-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

76221dbe7893236ff3b84e032805fac8d718d26751d5a2a47c19994fa251a6bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-09f48a4e2.edge-irl1.demdex.com 5.78.0.20200908113611 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: RbrVw4VQRf4=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 302
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: IhuOOeJ0QcA=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1601333855279
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 97ms
33ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Mon, 28 Sep 2020 22:57:36 GMT
x-host: s7.addthis.com
content-length: 116324

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 167 KB
76 KB 484ms
174ms Script
application/javascript 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
content-length: 77154
Last-Modified: Mon, 10 Aug 2020 17:22:54 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "29a67-5ac893472f780-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame 8DDB 0
0 157ms
38ms Document
text/html 52.49.59.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.59.93 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-59-93.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=13987652968919378753093207183746531983
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 09 Sep 2020 13:41:44 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=13987652968919378753093207183746531983;Path=/;Domain=.demdex.net;Expires=Sat, 27-Mar-2021 22:57:35 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: c2V/GaQURIk=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 48 B
483 B 105ms
26ms XHR
application/x-javascript 15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=14364500637768350353056648454194602759&ts=1601333855451

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

3726561908c992db9482619e2b9cae79ad210636ff125aadaa204f399bc1e8a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Mon, 28 Sep 2020 22:57:35 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-59cf767f97-gd2sc
vary: Origin
x-c: master-1376.I8e2bf4.M0-454
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X3JqYAAAB0_IbBTJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=13987652968919378753093207183746531983
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3JqYAAAB0_IbBTJ

42 B
915 B

34ms
33ms

Image
image/gif

3.248.30.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3JqYAAAB0_IbBTJ

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.30.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-30-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-065016f98.edge-irl1.demdex.com 5.78.0.20200908113611 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: rvs5nMmsS+4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 28 Sep 2020 22:57:35 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3JqYAAAB0_IbBTJ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 55 KB
56 KB 209ms
156ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:06 GMT
Server: Apache
ETag: "dde6-5673b5be4b580"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 56806

GET
H/1.1 200
OK deep-analysis-driver-based-mitm-malware-thumb.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/analysis_of_driver-based_mitm_malware_itranslator/ 164 KB
164 KB 156ms
156ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/analysis_of_driver-based_mitm_malware_itranslator/deep-analysis-driver-based-mitm-malware-thumb.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

a1560ea49eefd10f77beb855f9d853044f12fb750f6abd421c93ae14253de8fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Sep 2018 20:50:10 GMT
Server: Apache
ETag: "28e6b-5762b6f81c480"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 167531

GET
H/1.1 200
OK deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 35 KB
35 KB 162ms
161ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/deep-analysis-of-new-emotet-variant-part-2.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:32:08 GMT
Server: Apache
ETag: "8a6d-5673b5c033a00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 35437

GET
H/1.1 200
OK german-speakers-targeted-by-spam-leading-to-ozone-rat.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/ 10 KB
11 KB 155ms
155ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/individual-images/german-speakers-targeted-by-spam-leading-to-ozone-rat.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c8396eddcbd575ce4aa7b0d95bf200dbe79434b74649a086f16a454daebc5677

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 28 Sep 2020 22:57:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 12 Mar 2018 18:33:08 GMT
Server: Apache
ETag: "28d4-5673b5f96c100"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 10452

GET
H2 200 RCc1e0e9525773456f8571be34d2bb1032-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 1 KB
803 B 10ms
10ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RCc1e0e9525773456f8571be34d2bb1032-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 066bc5be3680f1a8adede6c9135a605261ddbae613cd5d03017fc0b0e1f67be8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 536
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 881 B
719 B 11ms
10ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: adf279aca9a65b52566b46e86e1a1dbdb46158a33d6f619d64984b3f3ed3c2f2

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 452
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 s18566187837695
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/ 43 B
658 B 26ms
25ms Image
image/gif 15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/s18566187837695?AQB=1&ndh=1&pf=1&t=29%2F8%2F2020%200%3A57%3A36%202%20-120&mid=14364500637768350353056648454194602759&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-1&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Adeep-analysis-of-new-emotet-variant-part-1&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
x-c: master-1380.Ie4fd2b.M0-456
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 29 Sep 2020 22:57:36 GMT
server: jag
xserver: anedge-794d66dbb8-776ck
etag: 3438838270834081792-4621515526228822036
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 27 Sep 2020 22:57:36 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 100ms
34ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=10571
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 hotjar-1178304.js Show response
static.hotjar.com/c/ 5 KB
2 KB 78ms
25ms Script
application/javascript 147.75.102.197
PACKET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

147.75.102.197 Central, Hong Kong, ASN54825 (PACKET, US),

Reverse DNS

pkt-ams-k2-shared-ingress11

Software

Resource Hash

f8d8382132ec97c5093b7778a054169a198cd63f0173738161c40306af7abe62

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
x-content-type-options: nosniff
content-type: application/javascript
section-io-tag: hotjarjs
age: 75
status: 200
section-io-cache: Hit
vary: Accept-Encoding
content-length: 1811
cache-control: max-age=60
etag: W/a0319ece01f4fbe52297e800a8a74a41
access-control-max-age: 600
section-io-origin-status: 304
access-control-allow-origin: *
x-cache-hit: 1
section-io-origin-time-seconds: 0.019
accept-ranges: bytes
section-io-id: 4e6d9557d9e1689709d37ae8b9b9618f
section-origin-responded: true

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 208 KB
62 KB 62ms
20ms Script
application/javascript 23.111.11.182
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 459929bf305435faee59ea9cca814903771cae16d5e76079672364ed37870382

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Thu, 24 Sep 2020 17:15:17 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 2WAY7MBGFW1VCSFG
etag: W/"481c37264d79536e56335950c448a01e"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: 3cEy2m7DcwRZVKTORgGahEugWvfOz25vjUsNFUVba0d8N/tnAAAXdZzsWXICL0Bqct5c+wIeVQ0=
expires: Thu, 23 Sep 2021 22:57:36 GMT

GET
H2 200 modules.357b13f05c394b8c0899.js Show response
script.hotjar.com/ 360 KB
70 KB 88ms
27ms Script
application/javascript 147.75.33.131
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.hotjar.com/modules.357b13f05c394b8c0899.js
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.33.131 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress9
Software: /
Resource Hash: 660bbbe52a0052fdc697189b6707f4d7aade3c49e0d29e2de0f6c781bab1be8f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
age: 33966
status: 200
section-io-cache: Hit
content-length: 71607
last-modified: Mon, 28 Sep 2020 13:31:31 GMT
etag: "cd7a32d8a20e5acad351b13db232a5d4"
vary: Accept-Encoding
section-io-origin-status: 200
access-control-allow-origin: *
cache-control: max-age=31536000
section-io-origin-time-seconds: 0.029
section-io-id: c7b56825b878201c5af975921e748696
accept-ranges: bytes
content-type: application/javascript
section-origin-responded: true

GET
H2 200 39852 Show response
api.omappapi.com/v2/embed/ 199 KB
16 KB 376ms
270ms XHR
application/json 99.86.243.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-128.vie50.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 4ff4677d4d89c87e1dbfe7f9c67aa2429db9fd58e9435b7463b57eefdc6aed0f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: VIE50-C1
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602
x-user-agent: standard--
last-modified: Thu, 26 Mar 2020 19:24:28 GMT
server: Pagely Gateway/1.5.1
etag: W/"9397cf735b776c93ec504d6f0f02a28a"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 c3369d9c96b77d67d8462b9636a6d7c2.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
cache-control: public, max-age=30, stale-while-revalidate=1800
access-control-allow-origin: *
x-amz-cf-id: I0jse_7Zc5x88hTySAvlnJcmSWWTt_Utfuuao93OGfTIdmPsEBLcdg==
expires: Mon, 28 Sep 2020 22:48:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 17ms
17ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

867df63b28e28131faffb48ce5ca621e32ae2c71e517d8d162b8b53b26f20cb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36424
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 21:09:55 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame A408 0
0 78ms
24ms Document
text/html 147.75.84.91
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.84.91 Parsippany, United States, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress13
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

status: 200
date: Mon, 28 Sep 2020 22:57:36 GMT
content-type: text/html
content-length: 851
last-modified: Mon, 28 Sep 2020 12:31:06 GMT
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
cache-control: max-age=31536000
content-encoding: br
section-io-origin-status: 200
section-io-origin-time-seconds: 0.090
section-origin-responded: true
age: 36471
vary: Accept-Encoding
section-io-cache: Hit
accept-ranges: bytes
section-io-id: dd2395a7fc3de8da2982d355d521a762

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 6116
date: Mon, 28 Sep 2020 21:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Mon, 28 Sep 2020 23:15:40 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
67 B 13ms
13ms XHR
text/plain 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1529183995&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&ul=en-us&de=UTF-8&dt=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=2091159612&gjid=2122479793&cid=460832277.1601333857&tid=UA-767980-1&_gid=1031959046.1601333857&_r=1&gtm=2ou9g1&z=1304991816

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 1021 B
866 B 7ms
6ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bc424b3ce528df11af9958ac1f6e55123a6452f3a0b5dbf8296371d771ed3830

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 600
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 819 B
768 B 7ms
7ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 906d0bceb491e59ffb50c52a8a6401ac516f38710df2f880e07b18e96d2de345

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 502
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 44ms
30ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a0a3aeba9f6afbe46e5561f7b3a286d9385f0fc99f872787b426b66ed7b65c2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36456
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 21:09:55 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 41ms
27ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eb3b1ef7544a864fad31c51aa26449cf907bcf041b5985bc1afd4c42f5eef0b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36419
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 21:09:55 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 47ms
33ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4c448cdd207e0107e154adfe282ff4f498a708f8a3494b48f4fbf7016563a1e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36455
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 21:09:55 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 44ms
30ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f411e61d82ff23c6885fbb17a032ebde566516d7070c56d8aa98b548cfa9df5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36412
x-xss-protection: 0
last-modified: Mon, 28 Sep 2020 21:09:55 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H2 200 RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 847 B
744 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 454fe5cdbe5a38e010ce28c7537c02ac776da3480f61f1732295c2a023bf6902

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 477
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H2 200 RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/ 664 B
666 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9969148ba1a5/RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bdb93f58428446936e3e2e77aaa6a8d70340749796c01554c305e28af117ad8a

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 22:29:01 GMT
server: AkamaiNetStorage
status: 200
etag: "2dadcb695cdd4e69135de3563907f17d:1601332141.608335"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 400
expires: Mon, 28 Sep 2020 23:57:36 GMT

GET
H/1.1 200 ipinfo Show response
site.fortinet.com/utilservice/ 198 B
730 B 509ms
173ms Script
application/json 96.45.36.159
FORTINET

General

Check archive.org

Show headers Download Go to

Full URL

https://site.fortinet.com/utilservice/ipinfo?site=fortinet.com&callback=jQuery22005258173709226104_1601333856005&_=1601333856006

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.45.36.159 San Jose, United States, ASN40934 (FORTINET, US),

Reverse DNS

Software

nginx/1.14.0 /

Resource Hash

9992dacade72c415c16c847ce7b30c9d0398ebf8342f908b8f0944785e3b62c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .fortinet.com .myfortinet.com fortinet.my.salesforce.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Server: nginx/1.14.0
Date: Mon, 28 Sep 2020 22:57:37 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json;charset=UTF-8
Connection: keep-alive
Content-Length: 198
Front-End-Https: on

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 371ms
92ms Script
application/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
Last-Modified: Fri, 13 Mar 2020 17:29:01 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Wed, 28 Sep 2022 22:57:36 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
756 B 196ms
195ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=60, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 91 B
251 B 186ms
184ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f726a601cfdfad2&bkl=0&bl=1&pdt=1861&sid=5f726a601cfdfad2&pub=ra-5d48adfc650f1a9e&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fortinet.com&fp=blog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=java%20script%2Cscript%2Crat%2Cmalware%2Cexe%2Cjs%2Ctrojan%2Cthreat%20research%2Cwindows%2CThreat%20Research%2Cemotet&colc=1601333856644&jsl=1&uvs=5f726a604f437a27000&skipb=1&callback=addthis.cbs.jsonp__0363677506226229850
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1231b0182800f0d06222d9815fc23c0c773cf749399e9d082c1d47668d2b7a2c

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 91
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 360D 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 100F 0
0 37ms
36ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Mon, 28 Sep 2020 22:57:36 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1178304/ 178 B
321 B 119ms
42ms XHR
application/json 63.32.141.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1178304/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.357b13f05c394b8c0899.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.32.141.164 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-32-141-164.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

POST
H2 204 1178304 Show response
vc.hotjar.io/sessions/ 0
116 B 105ms
47ms XHR
text/plain 147.75.100.245
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/1178304?s=0.25
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.357b13f05c394b8c0899.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.100.245 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS: pkt-ams-k2-shared-ingress2
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 28 Sep 2020 22:57:36 GMT
access-control-allow-origin: *
section-io-id: a930e394eac4f3b826f4b4e3723d5441
section-origin-responded: true

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 135 KB
34 KB 21ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34302
x-xss-protection: 0
pragma: public
x-fb-debug: z2/OJMmy9ntrvisEOqeHZGh0l53kH9XszRFMrHYoBt8fGcjLsDZxd9iJt9nV3/JQqAXaenl+Ab2qZ9j8DaSFJg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 28 Sep 2020 22:57:36 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 89ms
28ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
age: 82407
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-fra19171-FRA
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1601333857.742449,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 22ms
7ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=50818
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 155ms
37ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?298
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Content-Encoding: gzip
Last-Modified: Mon, 28 Sep 2020 18:07:36 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=68999
Connection: keep-alive
Content-Length: 11933
Expires: Tue, 29 Sep 2020 18:07:36 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 90ms
32ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 38 KB
13 KB 105ms
33ms Script
text/javascript 2.18.233.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e986347fae4cd3e188d0285b8c175fbda863568def399a7cc63663dc65eda556

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: d1pKkVEOnjXkhSna2LdckzCPNFxdQVqw
Content-Encoding: gzip
ETag: "e48ec93e4813a7969adbe0de01c4a49c"
x-amz-request-id: 8EB28073509C7335
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12201
x-amz-id-2: sI/NR0k1GE753WXWS6GJiwma/FFWZEPSGmDoBDTMXYrYEd0e1NacCh69FANqx3U9uLFHX5HecL8=
Last-Modified: Thu, 24 Sep 2020 20:19:10 GMT
Server: AmazonS3
Date: Mon, 28 Sep 2020 22:57:36 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=20062
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 177020962864941 Show response
connect.facebook.net/signals/config/ 524 KB
132 KB 9ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fa2fa4692158301cf4285de1f671edbd6d65058732186bbc55d17a85e45a8d27

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 134828
x-xss-protection: 0
pragma: public
x-fb-debug: q/0qdq9rhs9pFkGO8RJuTxFpoApLEk5H2To2LigKho8Ye/ytC/2PVFsDtXxKSuKGvIms4tdNIqglLeYD7qjGlQ==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 28 Sep 2020 22:57:36 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1601333856732%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true

0
81 B

119ms
119ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:37 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: RoULpKgUORbwjxcFVSsAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: KTb+n6gUORYAZ/atvyoAAA==
pragma: no-cache
x-li-pop: afd-prod-edc2
x-msedge-ref: Ref A: 462D5BF385854345B37E4A13DCD9F0B5 Ref B: FRAEDGE0721 Ref C: 2020-09-28T22:57:36Z
x-frame-options: sameorigin
date: Mon, 28 Sep 2020 22:57:36 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1601333856732&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
376 B 20ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&rl=&if=false&ts=1601333856771&sw=1600&sh=1200&v=2.9.24&r=stable&ec=0&o=30&fbp=fb.1.1601333856770.125921367&it=1601333856728&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 28 Sep 2020 22:57:36 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 208ms
148ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Mon, 28 Sep 2020 22:57:36 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 623dcdcf5ce05ef783af446477418cdb
x-transaction: 0004c86c00654b01
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 201ms
146ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Mon, 28 Sep 2020 22:57:36 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 0bd6cef51fe5c28585485daa35548cbd
x-transaction: 002c492200804115
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 2 KB
2 KB 38ms
18ms Script
text/javascript 2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1601333856786&cv=9&fst=1601333856786&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1af521874d725b56a5377397ee7556746e79cdc9aa7cb94f20b58481a4b1e151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1091
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 2 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1601333856788&cv=9&fst=1601333856788&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039c2a18a94668446f0c77673da0c23e7632fb8a8aaae65aa52f3274caac4d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1096
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1601333856790&cv=9&fst=1601333856790&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a55af1ce2e4e30ff766b0880592126670e3a92f038629404a94ef87bb7628133

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1089
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1601333856791&cv=9&fst=1601333856791&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&ig=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d48cfb79489fa36e74b236197b2c58c308d85e678fc3de32a85612ffae1c613

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1096
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

37ms
32ms

Script
application/javascript

2.18.233.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2U8XMvdFINXJNFsilaXONuSvqmREKV3.
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: 0A9DFB41B15EF3A2
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 9wtYzl8isf76a+KTcCc0hWCh/ZKrxXSL0KsmsoDDvS1VGgWl/GxdSe7DtPnOmbh4BH+84jF1nEY=
Last-Modified: Fri, 31 Jul 2020 16:11:15 GMT
Server: AmazonS3
Date: Mon, 28 Sep 2020 22:57:37 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 28 Sep 2020 22:57:37 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 1 KB
1 KB 91ms
31ms Script
text/javascript 2.18.233.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: .BmpcLrSzIOaA0LNXzRrq1pyjM_0hfW4
Content-Encoding: gzip
ETag: "3996d65282dd996ee0d7d4c90c139158"
x-amz-request-id: 88E07FD71D762A05
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 635
x-amz-id-2: x+nuRdMgxDclDYF5UgFwet6LvEokTj3jNM6rt9OghfAhuCZiX75qydNO9yFDRq0fjD7f1L2oc5Y=
Last-Modified: Mon, 28 Sep 2020 17:53:15 GMT
Server: AmazonS3
Date: Mon, 28 Sep 2020 22:57:36 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=64e3417413d5838f12a464d73b3b9658&_b=2
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=64e3417413d5838f12a464d73b3b9658&_b=2

385 B
478 B

116ms
39ms

Script
application/javascript

52.215.248.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=64e3417413d5838f12a464d73b3b9658&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.248.90 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-248-90.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2478e84fe7bdcc88374dde8a450b59d67747570f51c5a5d2ab1339b9da72a69d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 28 Sep 2020 22:57:37 GMT
server: nginx/1.18.0
content-length: 385
content-type: application/javascript

Redirect headers

status: 302
date: Mon, 28 Sep 2020 22:57:36 GMT
server: nginx/1.18.0
content-length: 105
location: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=64e3417413d5838f12a464d73b3b9658&_b=2

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 644 B
1 KB 40ms
37ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&pv=1601333856827_6nri8892j&bl=en-us&cb=4263856&return=&ht=&d=&dc=&si=1601333856827_6nri8892j&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?298
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1109118c25b6278fe3f7bf820f27bf60afff4604ea010aeab5f2a9b04af6246d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Sep 2020 22:57:36 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 468
Expires: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
560 B 39ms
20ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1601333856786&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=3296278655&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/662878185/ 42 B
560 B 41ms
19ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/662878185/?random=1601333856786&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=3296278655&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
107 B 20ms
19ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1601333856788&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=4197186317&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/662878185/ 42 B
107 B 23ms
20ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/662878185/?random=1601333856788&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=4197186317&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
65 B 44ms
27ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1601333856790&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=1193741879&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/609297413/ 42 B
107 B 22ms
19ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/609297413/?random=1601333856790&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=1193741879&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
538 B 41ms
25ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1601333856791&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=3662371172&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/609297413/ 42 B
107 B 21ms
18ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/609297413/?random=1601333856791&cv=9&fst=1601330400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa9g1&sendb=1&data=event%3Doptimize.callback&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&tiba=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&async=1&fmt=3&is_vtc=1&random=3662371172&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 34ms
34ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Mon, 28 Sep 2020 22:57:36 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H/1.1 200
OK ibs:dpid=22052&dpuuid=3613454624348962863&redir=
dpm.demdex.net/ 42 B
915 B 34ms
33ms Image
image/gif 3.248.30.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3613454624348962863&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.248.30.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-248-30-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-07819e633.edge-irl1.demdex.com 5.78.0.20200908113611 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: TCiZUBpfTOE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3613454624348962863
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxMzQ1NDYyNDM0ODk2Mjg2MxAAGg0I4NTJ-wUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=76aea8112161a796612b4f1b1066020a474c41cb3e4eecafd96bce64da0dfe05f4cb09cee1a4f8eb&person_id=3613454624348962863&eid=50082

43 B
312 B

37ms
36ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=76aea8112161a796612b4f1b1066020a474c41cb3e4eecafd96bce64da0dfe05f4cb09cee1a4f8eb&person_id=3613454624348962863&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 29 Sep 2020 18:57:37 GMT

Redirect headers

date: Mon, 28 Sep 2020 22:57:37 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=76aea8112161a796612b4f1b1066020a474c41cb3e4eecafd96bce64da0dfe05f4cb09cee1a4f8eb&person_id=3613454624348962863&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba
https://ml314.com/csync.ashx?fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba&person_id=3613454624348962863&eid=53819

43 B
312 B

73ms
36ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba&person_id=3613454624348962863&eid=53819
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:37 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 29 Sep 2020 18:57:37 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 28 Sep 2020 22:57:36 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ml314.com/csync.ashx?fp=254c0b12-13cd-4743-9ac2-4c03cf3a2dba&person_id=3613454624348962863&eid=53819
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0,Tue, 29 Sep 2020 18:57:37 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3613454624348962863
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3613454624348962863
https://ml314.com/csync.ashx?fp=bda8d7322a9a5a5cae5e1d8d85cbd7a8&eid=50146&person_id=3613454624348962863

43 B
312 B

54ms
36ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=bda8d7322a9a5a5cae5e1d8d85cbd7a8&eid=50146&person_id=3613454624348962863
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:36 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 29 Sep 2020 18:57:37 GMT

Redirect headers

pragma: no-cache
date: Mon, 28 Sep 2020 22:57:37 GMT
status: 302
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ml314.com/csync.ashx?fp=bda8d7322a9a5a5cae5e1d8d85cbd7a8&eid=50146&person_id=3613454624348962863
cache-control: no-cache
x-server: 10.45.3.2
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

0
344 B

25ms
25ms

Image
text/plain

3.121.27.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.121.27.153 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-27-153.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:37 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=r8hrb20&t=gif
Date: Mon, 28 Sep 2020 22:57:37 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 json Show response
api.omappapi.com/v3/geolocate/ 559 B
967 B 151ms
150ms XHR
application/json 99.86.243.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v3/geolocate/json
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-128.vie50.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 73da9d8d5035fdf8a9fb5e291722e98a9245df4e935c51f3fe14886ba2b12cb6

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:36 GMT
via: 1.1 c3369d9c96b77d67d8462b9636a6d7c2.cloudfront.net (CloudFront)
x-cache-config: 0 0
x-amz-cf-pop: VIE50-C1
x-cache-status: BYPASS
x-cache: Miss from cloudfront
status: 200
content-length: 559
x-user-agent: standard--
server: Pagely Gateway/1.5.1
x-ratelimit-remaining: 999
content-type: application/json
access-control-allow-origin: *
x-ratelimit-reset: 1601333916
x-ratelimit-limit: 1000
x-pagely-debug: mainblock
x-amz-cf-id: E6wgrWcOOcjRLuYA-Mxo0x8Ej17wFjLAIVUwtamk70ufP6Oro7Uw5A==

GET
H2 200 webfont.js Show response
a.omappapi.com/app/js/webfont/1.5.18/ 16 KB
7 KB 46ms
14ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Sep 2020 22:57:37 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 35985FD0BD2D0504
etag: W/"593e60ad549e46f8ca9a60755336c7df"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: xWRPVaNyTjfxdQORJem1xstNV0mXhE1y5XY/6xlv3s0lufygz6NcEZW+zCvAQ5HIowAacM4gnAQ=
expires: Thu, 23 Sep 2021 22:57:37 GMT

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 2 KB
2 KB 273ms
272ms Script
text/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: dc8dfbaea63ef8db4db858b6b1e616dc3f4b60dc5361e38d9ddc08efb98b6daf

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Sep 2020 22:57:37 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
X-Pardot-Rsp: 16/70/179
Vary: Accept-Encoding,User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 839
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 388 KB
53 KB 44ms
44ms Script
application/javascript 2.18.233.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 4414e7ba689b11879898a6fb3fc66eadcabe463a10cac1eb6aa05aa57e5e8c7b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Y6MeM70zw3uq00fRStz3ssEjU2kqqZux
Content-Encoding: gzip
ETag: "486c34ecfd7aa55b21bb7a44135b232d"
x-amz-request-id: 4E10C59FBBEAB941
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Vary: Accept-Encoding
x-amz-id-2: pAk9dEaS+zCtICLYEPg8EaESdrkmUBkJyf1W80mZVnFMsX0mJxx8C+FVfzTMeMYeq1TnsGsANKQ=
Last-Modified: Mon, 21 Sep 2020 19:05:40 GMT
Server: AmazonS3
Date: Mon, 28 Sep 2020 22:57:37 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK favicon-32x32.png
nextroll.com/ 2 KB
2 KB 296ms
99ms Image
image/png 35.153.56.97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextroll.com/favicon-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.153.56.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-153-56-97.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 22:57:37 GMT
Via: 1.1 vegur
Last-Modified: Thu, 17 Sep 2020 17:32:07 GMT
Server: Apache
Etag: "64f-5af85c36153c0"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1615

POST
H2 200 /
www.facebook.com/tr/ 0
107 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTHnhcC11DUlbqvUf

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Mon, 28 Sep 2020 22:57:37 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H/1.0 200
OK analytics Show response
go.fortinet.com/ 52 B
1 KB 467ms
174ms Script
text/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.fortinet.com/analytics?conly=true&visitor_id=29619395&visitor_id_sign=cfa543bd7b8c6502985151a4977121ab7c46e993d46d830a3e0da8c56e49da5524ab36d6b04aade020ec8e370bc1a83ebda3ec6c&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Deep%20Analysis%20of%20New%20Emotet%20Variant%20%E2%80%93%20Part%201&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1&referrer=
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825

Request headers

Referer: https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Sep 2020 22:57:37 GMT
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
X-Pardot-Rsp: 16/99/131
Vary: User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 52
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

184 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-19 12:48:55	Name: __atuvs Value: 5f726a604f437a27000
www.fortinet.com/	1970-01-19 22:17:41	Name: __atuvc Value: 1%7C40
.fortinet.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
www.fortinet.com/	1969-12-31 23:59:59	Name: cookiesession1 Value: 47695768HN18CQDOBP1IRXY0Q0VNF950
www.fortinet.com/	1970-01-19 12:48:54	Name: _omappvs Value: 1601333856503
.fortinet.com/	1970-01-19 12:50:20	Name: _gid Value: GA1.2.1031959046.1601333857
.demdex.net/	1970-01-19 17:08:05	Name: demdex Value: 13987652968919378753093207183746531983
.fortinet.com/	1970-01-20 06:20:05	Name: _ga Value: GA1.2.460832277.1601333857
.fortinet.com/	1970-01-20 06:20:05	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 359503849%7CMCIDTS%7C18534%7CMCMID%7C14364500637768350353056648454194602759%7CMCAAMLH-1601938655%7C6%7CMCAAMB-1601938655%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1601341055s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18541%7CvVersion%7C5.0.1
.fortinet.com/	1970-01-19 12:48:53	Name: _gat_gtag_UA_767980_1 Value: 1
.fortinet.com/	1970-01-19 12:48:55	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fdeep-analysis-of-new-emotet-variant-part-1
.fortinet.com/	1970-01-20 06:20:05	Name: s_ecid Value: MCMID%7C14364500637768350353056648454194602759
.fortinet.com/	1970-01-19 14:58:29	Name: s_getNewRepeat Value: 1601333856329-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
.fortinet.com/	1970-01-19 21:34:29	Name: _hjid Value: ee9f507a-4acf-41cf-a3f0-f4d18adf4eea
www.fortinet.com/	1970-01-23 12:47:27	Name: _omappvp Value: vNyVpU6eQsq2FPlLWdXOyfi3AcwglKHo6ymWoYSVz8CePftP1V1b6VKeTzfN3FxtZnf16YUBmWhxpcUis8TXF1MMRehJBXcz

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.omappapi.com
a.opmnstr.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
blog.fortinet.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
fortinet.demdex.net
go.fortinet.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.hotjar.com
m.addthis.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
nextroll.com
pi.pardot.com
ps.eyeota.net
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
script.hotjar.com
site.fortinet.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
sync.crwdcntrl.net
t.co
v1.addthisedge.com
vars.hotjar.com
vc.hotjar.io
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
s7.addthis.com
104.244.42.197
104.244.42.3
13.56.33.144
147.75.100.245
147.75.102.197
147.75.33.131
147.75.84.91
15.236.9.100
151.101.12.157
172.217.21.226
2.18.233.40
2.18.235.40
23.111.11.182
23.111.11.71
23.210.248.44
2620:1ec:21::14
2a00:1450:4001:819::2003
2a00:1450:4001:819::2004
2a00:1450:4001:81a::2008
2a00:1450:4001:81a::200e
2a00:1450:4001:824::2002
2a02:26f0:6c00:296::25ea
2a02:26f0:6c00:299::1e80
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.121.27.153
3.248.30.231
34.120.207.148
34.246.29.23
34.253.167.156
35.153.56.97
35.174.150.168
35.174.151.106
52.211.146.59
52.215.248.90
52.49.59.93
54.77.58.217
63.32.141.164
66.117.28.86
96.45.36.159
99.86.243.128
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
05ea6f9aabf5fcf07b9a7724bc0ef9c4fa8d811b5df669112ae9124443a472aa
066bc5be3680f1a8adede6c9135a605261ddbae613cd5d03017fc0b0e1f67be8
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
0b15b4377a9bb3c650e14f104ff2a36eee7aa8c566f75c819e58c0bce00b36a5
0d32e1fbdf765264e5622fce18c8dff32ed318619d4d1b36cadb95d5d8ce8948
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1109118c25b6278fe3f7bf820f27bf60afff4604ea010aeab5f2a9b04af6246d
1231b0182800f0d06222d9815fc23c0c773cf749399e9d082c1d47668d2b7a2c
1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
134597068595db606c339a0d5984297c453da7bd2d7888b4a8d59a912cf9a1e1
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
1af521874d725b56a5377397ee7556746e79cdc9aa7cb94f20b58481a4b1e151
1f411e61d82ff23c6885fbb17a032ebde566516d7070c56d8aa98b548cfa9df5
2039c2a18a94668446f0c77673da0c23e7632fb8a8aaae65aa52f3274caac4d7
2478e84fe7bdcc88374dde8a450b59d67747570f51c5a5d2ab1339b9da72a69d
2769ca5ab6b82d7e78029c047d2ad2c9509473541a3ddae53f3a07086a98c0a8
33379cd3124278877df5e3776a342e8282fb7bfd33edbdd131a1d80aec2dc6be
3726561908c992db9482619e2b9cae79ad210636ff125aadaa204f399bc1e8a7
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
4414e7ba689b11879898a6fb3fc66eadcabe463a10cac1eb6aa05aa57e5e8c7b
454fe5cdbe5a38e010ce28c7537c02ac776da3480f61f1732295c2a023bf6902
459929bf305435faee59ea9cca814903771cae16d5e76079672364ed37870382
4c448cdd207e0107e154adfe282ff4f498a708f8a3494b48f4fbf7016563a1e0
4d48cfb79489fa36e74b236197b2c58c308d85e678fc3de32a85612ffae1c613
4ff4677d4d89c87e1dbfe7f9c67aa2429db9fd58e9435b7463b57eefdc6aed0f
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5cac00caee3e442510cda0c641976c0a5245acdbb7d6d853d74f3740b39f4b06
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
660bbbe52a0052fdc697189b6707f4d7aade3c49e0d29e2de0f6c781bab1be8f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
73da9d8d5035fdf8a9fb5e291722e98a9245df4e935c51f3fe14886ba2b12cb6
76221dbe7893236ff3b84e032805fac8d718d26751d5a2a47c19994fa251a6bb
797ac4f126723e434e5b1f5f857ce1d21fa34370030b679e21df00df3279ce19
7ab56721300f018e546467bf273f8ddef14a3de34f96a7b46dec36c86cd16b0e
7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
867df63b28e28131faffb48ce5ca621e32ae2c71e517d8d162b8b53b26f20cb8
906d0bceb491e59ffb50c52a8a6401ac516f38710df2f880e07b18e96d2de345
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
929d840a255355f0ef708b4ec54d37ab16392b8176a330dc97e0a2d34cfa8054
9992dacade72c415c16c847ce7b30c9d0398ebf8342f908b8f0944785e3b62c7
9a79bdb5e88745d369e9a9916cf8ee11d6df45f02c5afff20a75386b1e99c67d
9ce9e23b2f0aff01f3a20cde4e99e014e306dfb3c420bee920ea9e0f323a6ccc
a0a3aeba9f6afbe46e5561f7b3a286d9385f0fc99f872787b426b66ed7b65c2a
a1560ea49eefd10f77beb855f9d853044f12fb750f6abd421c93ae14253de8fc
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a55af1ce2e4e30ff766b0880592126670e3a92f038629404a94ef87bb7628133
a579d3a189415086da085a6953df6f2929cc7cff093c6e83ee6d5f026b1d0505
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adf279aca9a65b52566b46e86e1a1dbdb46158a33d6f619d64984b3f3ed3c2f2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6c29512b7d321aa70701ef365f1f6c7ea25dff345206a54e5304216135f3e38
bc424b3ce528df11af9958ac1f6e55123a6452f3a0b5dbf8296371d771ed3830
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
bdb93f58428446936e3e2e77aaa6a8d70340749796c01554c305e28af117ad8a
c365e3170a06fdf90a7abceab2abf62c8aa658a870e7310d9041f6550cadd467
c8396eddcbd575ce4aa7b0d95bf200dbe79434b74649a086f16a454daebc5677
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d73dc6d4597be4d66d2dbf8cd51e03251507a849c35bb5a1f97f0651fb438b91
d9975b62cb26a9dae9b2b0878ab302c37aec37c6f6b6fe2620d184cd7b8b76bd
dc8dfbaea63ef8db4db858b6b1e616dc3f4b60dc5361e38d9ddc08efb98b6daf
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e986347fae4cd3e188d0285b8c175fbda863568def399a7cc63663dc65eda556
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
eb3b1ef7544a864fad31c51aa26449cf907bcf041b5985bc1afd4c42f5eef0b4
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f1a68763b703a2efc6d778b7c89565f48882d3e667051006420b4b1537e9a9a1
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f8d8382132ec97c5093b7778a054169a198cd63f0173738161c40306af7abe62
fa2fa4692158301cf4285de1f671edbd6d65058732186bbc55d17a85e45a8d27

www.fortinet.com Open in urlscan Pro 13.56.33.144 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

99 Requests

99 %HTTPS

26 %IPv6

33 Domains

45 Subdomains

37 IPs

7 Countries

1525 kBTransfer

4300 kBSize

17 Cookies

10 Outgoing links

Page URL History

Redirected requests

99 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Screenshot
Live screenshot

Full Image

99
Requests

99 %
HTTPS

26 %
IPv6

33
Domains

45
Subdomains

37
IPs

7
Countries

1525 kB
Transfer

4300 kB
Size

17
Cookies

99 HTTP transactions
2 data transactions