www.fortinet.com Open in urlscan Pro
18.156.16.255  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

• https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid=481ACCEB3BB9C44C-2A0C76CE87C1D538&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
• https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&pccr=true&vidn=32CA8CD984BD29B0-40001069405B0A03&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid=481ACCEB3BB9C44C-2A0C76CE87C1D538&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

39 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request bandook-persistent-threat-that-keeps-evolving Show response www.fortinet.com/blog/threat-research/	51 KB 18 KB	169ms 46ms	Document text/html	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 2221e75da3dd41538fba684b5355135d4bd0e73bfb1c0042aa9fcece1e82858f Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Age 44547 Cache-Control max-age=600, public, s-maxage=10800 Connection keep-alive Content-Encoding gzip Content-Length 17312 Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Type text/html;charset=utf-8 Date Wed, 03 Jan 2024 08:20:48 GMT ETag "cce4-60dfbf8205f92-gzip" Last-Modified Tue, 02 Jan 2024 20:01:51 GMT Server Apache Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Id tRBu0UaIyg6ghQXD03LWVy_VmVTq6bbUTd55IRCxsSD4gboUvMNcHA== X-Amz-Cf-Pop FRA60-P3 X-Cache Hit from cloudfront X-Content-Type-Options nosniff X-Dispatcher dispatcher1uswest1 X-Frame-Options SAMEORIGIN X-Vhost publish X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	at.js Show response www.fortinet.com/etc/designs/fortinet/adb-target/	104 KB 48 KB	118ms 45ms	Script application/javascript	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 27 Dec 2023 18:59:53 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 566664 Connection keep-alive Content-Length 47782 X-XSS-Protection 1; mode=block Last-Modified Fri, 31 Mar 2023 18:09:20 GMT Server Apache ETag "19e83-5f8361bb01400-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id GhFjxxdx1MLm6C9iyXPvAP0GSvrq1Byo5bDuQ-hbaR_FqvNH1Ew6VA==
GET H/1.1	200 OK	clientlib-base.min.css www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	540 KB 28 KB	72ms 43ms	Stylesheet text/css	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:18:01 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 1607840 Connection keep-alive Content-Length 27479 X-XSS-Protection 1; mode=block Last-Modified Thu, 02 Nov 2023 22:08:43 GMT Server Apache ETag "86e18-60932a18310c0-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type text/css;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id a035MepZdWGEFRAhyt4xKZyoQPZr2bh8t59zXUtjIRd7inm6xRzMYg==
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	21 KB 7 KB	136ms 52ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6d72fa0f78c80b1874d3ee4aadf43d973edc442a65fef83d37e684ac559893b7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 5rel+BW+cbOCNkEJ4C4NBQ== age 79515 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 6841 x-ms-lease-status unlocked last-modified Thu, 21 Dec 2023 21:19:55 GMT server cloudflare etag 0x8DC026A943751A5 vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id d530a67f-201e-0007-3283-3455e0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83a7afd35df-FRA
GET H/1.1	200 OK	fortinet-logo-white.svg www.fortinet.com/content/dam/fortinet-blog/	32 KB 3 KB	166ms 47ms	Image image/svg+xml	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:18:01 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 11474577 Content-Disposition attachment; filename="fortinet-logo-white.svg" Connection keep-alive Content-Length 1998 X-XSS-Protection 1; mode=block Last-Modified Thu, 22 Feb 2018 23:16:01 GMT Server Apache ETag "7ebb-565d53a1d6e40-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type image/svg+xml Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id OdpKoLo_Rj22g4w5JZoBJD6cgAe3mTpkolwDczhYAGNYzvIOd2yF2g==
GET H/1.1	200 OK	toc-icon.jpg www.fortinet.com/content/dam/fortinet/images/	1 KB 3 KB	165ms 45ms	Image image/jpeg	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 4286994 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 1277 X-XSS-Protection 1; mode=block Last-Modified Tue, 14 Nov 2023 17:34:13 GMT Server Apache ETag "4fd-60a2031eb4f40" X-Frame-Options SAMEORIGIN Content-Type image/jpeg Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id qCboNioS392E89M_8ZBEUUWu7Kob9hFpJoL1H4MlI16Kl0Nbq7YLXw==
GET H/1.1	200 OK	clientlib-base.min.js Show response www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/	155 KB 71 KB	46ms 46ms	Script application/javascript	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9025f5763fcba60d492d22d0e56c3cfc022b41280a3bbcf78fb12bf4306cd0b0 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Tue, 02 Jan 2024 09:20:19 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Content-Encoding gzip Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 X-Vhost publish X-Cache Hit from cloudfront Age 83039 Connection keep-alive Content-Length 71667 X-XSS-Protection 1; mode=block Last-Modified Thu, 14 Dec 2023 22:43:09 GMT Server Apache ETag "26be7-60c8001fd7940-gzip" X-Frame-Options SAMEORIGIN Vary Accept-Encoding Content-Type application/javascript;charset=utf-8 Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id lnhVheXcpu09onkKzt6UQkAQ0Tt6-z-4WZeGjVCzhz7OcENhGFfYwQ==
GET H2	200	f85f39fc-d7aa-467a-b762-fbb722748016.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/	5 KB 2 KB	139ms 58ms	XHR application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 42833 content-md5 Uj3iBUKm1Vl2g2NHq67V+w== content-length 1792 x-ms-lease-status unlocked last-modified Thu, 28 Dec 2023 19:56:54 GMT server cloudflare etag 0x8DC07DF23DF5130 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 67257c4e-101e-0033-60c8-396628000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83b5b0bbb9d-FRA expires Thu, 04 Jan 2024 08:24:18 GMT
GET DATA	200 OK	truncated /	71 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	mandook-hero.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	325 KB 327 KB	47ms 47ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/mandook-hero.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 45afacae575d4b5b9246fc189ab92cd3ab923a03cc57bf7b02d844fb1c709113 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095544 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 333102 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:46:19 GMT Server Apache ETag "5152e-60cdf9b0facc0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id R5Ob0qsRNbHy3OAQpN6Sj7nxeXRnjHV-8eb_c7MZQPbzzSQ674iddA==
GET H/1.1	200 OK	teamcity-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	52 KB 53 KB	48ms 47ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/teamcity-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 7a7926b29f0f2803f7767e7a018783891498cb6a76c0abb5cd2bc0e9400c5dd3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095686 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 53049 X-XSS-Protection 1; mode=block Last-Modified Sat, 09 Dec 2023 00:56:24 GMT Server Apache ETag "cf39-60c092b7b3e00" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id iDUdWl7AjIL797S2GRkM-VaImhjC6iYN72QX8SEdcTrmnD3U36BKxA==
GET H/1.1	200 OK	mranon-stealer-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	49 KB 51 KB	59ms 44ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/mranon-stealer-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 6693ca64ed25947f20674723a171270855165f18faefe98c273031877041ecc2 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1782922 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 50560 X-XSS-Protection 1; mode=block Last-Modified Tue, 05 Dec 2023 15:41:05 GMT Server Apache ETag "c580-60bc50ffd8640" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id qo-UofkeoHV_IJnObmJe9CFYS8_g7Smu2U5aQfCneWWnqhX3WfGJBg==
GET H/1.1	200 OK	gotitan-thumbnail.png.thumb.319.319.png www.fortinet.com/content/dam/fortinet-blog/article-heros/	44 KB 46 KB	63ms 43ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/content/dam/fortinet-blog/article-heros/gotitan-thumbnail.png.thumb.319.319.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash d687db0c07ec775db39e2ea1ef235a8f7e65c5600e0b75697eb8c21002a51780 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Wed, 03 Jan 2024 08:20:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1095685 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 45240 X-XSS-Protection 1; mode=block Last-Modified Wed, 22 Nov 2023 19:52:09 GMT Server Apache ETag "b0b8-60ac30df00c40" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id x6rqcf0Yeb90HIFTdCRVpjn2EJD51Wh-Aqgsu-c_4TdlzKSFdeOsOA==
GET H/1.1	200 OK	UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 www.fortinet.com/etc/designs/fortinet/gfonts/	37 KB 38 KB	58ms 44ms	Font application/octet-stream	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 Requested by Host: www.fortinet.com URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css Origin https://www.fortinet.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher1uswest1 Date Tue, 19 Dec 2023 19:39:43 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 1255553 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 37716 X-XSS-Protection 1; mode=block Last-Modified Wed, 18 May 2022 21:08:06 GMT Server Apache ETag "9354-5df4fa74ff980" X-Frame-Options SAMEORIGIN Content-Type application/octet-stream Cache-Control max-age=2000000, public Accept-Ranges bytes X-Amz-Cf-Id VSW2Wc92qtOU0-Hwzy2eytPS6hZXLu2DuZ19enSyEsCBwpTdilopvA==
GET H/1.1	200 OK	fig01-bandook-registry-keys-written.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1049625597.img.png/1702997925527/	58 KB 59 KB	70ms 41ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1049625597.img.png/1702997925527/fig01-bandook-registry-keys-written.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 371c9597b00819e8e4a4f2035c0997e2a30c482e874d88eab69bb81146bafa46 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53755 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 59238 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 14:58:45 GMT Server Apache ETag "e766-60cde1a5f7340" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id 08aQnbXjL2RH_b9BqAlQh9kUVHD7SWbBbRJnuUn7UgPWeW9NEOkm6A==
GET DATA	200 OK	truncated /	42 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	fig02-bandook-payload-execution-flow.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1906578527.img.png/1702997942101/	49 KB 50 KB	87ms 46ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1906578527.img.png/1702997942101/fig02-bandook-payload-execution-flow.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 8f5151071c493e7a759e47b198f17a3e5a9bb0cd5e79579d6bbbc7c31125a058 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:17 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51959 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 50271 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 14:59:02 GMT Server Apache ETag "c45f-60cde1b62d980" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id zIpZOc6dBt7vIOPuYvSPGz32WnGxwIyjAca6t5ShloVT4ZbZcL9rDw==
GET H/1.1	200 OK	fig03-bandook-relationship-value-cmd-payload.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1702998011262/	78 KB 80 KB	46ms 46ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1702998011262/fig03-bandook-relationship-value-cmd-payload.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 56efa8f091bacb485ca34ebcb2efc799c4a7d1b5de7162a657caf0a49932b432 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53755 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 80199 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 15:00:11 GMT Server Apache ETag "13947-60cde1f7fb4c0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id cqwvT_k9iE5Z7JtkGLpCUNR4wBwx-EvtJXhp5n3mKRg6WWUV3oRs8w==
GET H/1.1	200 OK	fig04-bandook-traffic-capture-aes-decrypted-data.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_434310331.img.png/1702998030791/	113 KB 114 KB	44ms 44ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_434310331.img.png/1702998030791/fig04-bandook-traffic-capture-aes-decrypted-data.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash c43ffae5330275f609cbe1bca236321134ceaa5af31923ea4c5076438050950a Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 6ae82cc0c8a39c993134c2be90b4d120.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53755 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 115702 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 15:00:30 GMT Server Apache ETag "1c3f6-60cde20a19f80" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id sgRxvaBQwrpX2c-4hYMRcovSupzQVaWGMjrVz9_eUzb7p9l1WbRsDw==
GET H/1.1	200 OK	fig05-bandook-0133-found-fcd-dll.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1050315341.img.png/1703003775082/	102 KB 104 KB	44ms 44ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1050315341.img.png/1703003775082/fig05-bandook-0133-found-fcd-dll.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 2013659dd9f07a11220e2a06182d03454734045c770597b17a3e0b567972174e Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 52604 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 104849 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:36:15 GMT Server Apache ETag "19991-60cdf770f5dc0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id MjZCNT0kL4T2jPkYZeCZrhNoWrs1KSfbDsQPPrpYeqmwjkhaozb2ew==
GET H/1.1	200 OK	fig06-bandook-process-flow-0003-server.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1097496786.img.png/1703003801536/	35 KB 37 KB	43ms 43ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1097496786.img.png/1703003801536/fig06-bandook-process-flow-0003-server.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 5b54fbd94972daaa27b650968b92ffdf3de9fbe62389240656f7b550b33a8db7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51828 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 36276 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:36:41 GMT Server Apache ETag "8db4-60cdf789c1840" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id hTIzknrY4RZYDHHwwiDr71Ccv2sZFQu1ivBP3_KbJE91oQ64-5VHOg==
GET H/1.1	200 OK	fig07-bandook-process-flow-0007-server.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_729357284.img.png/1703003824848/	29 KB 30 KB	48ms 48ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_729357284.img.png/1703003824848/fig07-bandook-process-flow-0007-server.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 1f5e55c4511be090aa549285a211959e5caf5f8fe9987ec3a7d5390276668f38 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 51960 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 29777 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:04 GMT Server Apache ETag "7451-60cdf79fb0c00" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id hojqSoU-xrdCZ7s-al-WULUJPaZjhPbGkXUeXq94UkC1K3rADhZeRA==
GET H/1.1	200 OK	fig08-bandook-ave-maria-number-sent.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1000005743.img.png/1703003855600/	64 KB 65 KB	43ms 43ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_1000005743.img.png/1703003855600/fig08-bandook-ave-maria-number-sent.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 01020da344780c2fb0b39707abda1744bbfe7a6815396c28c27855aa775d81a3 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53754 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 65434 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:35 GMT Server Apache ETag "ff9a-60cdf7bd411c0" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id i5HObfT3a8kIJxMqTZbwUQvdzvuJDv1vo89QYJRPZ7wiA5UqxEM-Yg==
GET H/1.1	200 OK	fig09-bandook-new-variant-same-function-control-code-and-command.png www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_913559379.img.png/1703003876714/	77 KB 79 KB	42ms 42ms	Image image/png	18.156.16.255 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving/_jcr_content/root/responsivegrid/table_content/par/image_913559379.img.png/1703003876714/fig09-bandook-new-variant-same-function-control-code-and-command.png Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 18.156.16.255 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-16-255.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 30296cfda6375fccc0a3d66da97298809a0891b866fb15a96b9c37a64d79c2c7 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers X-Dispatcher dispatcher2uswest1 Date Wed, 03 Jan 2024 02:23:18 GMT Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Content-Security-Policy frame-ancestors 'self' https://www.fortinet.com Via 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA60-P3 Age 53754 X-Vhost publish X-Cache Hit from cloudfront Connection keep-alive Content-Length 79246 X-XSS-Protection 1; mode=block Last-Modified Tue, 19 Dec 2023 16:37:56 GMT Server Apache ETag "1358e-60cdf7d148100" X-Frame-Options SAMEORIGIN Content-Type image/png Cache-Control max-age=684000, public Accept-Ranges bytes X-Amz-Cf-Id P8Fk8riTDhASbPfXkkoGgWZetLaDpjWSMjeBTX4XdXLEx3TIITKEhA==
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 295 B	143ms 58ms	XHR application/json	2606:4700:4400::ac40:9b77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept application/json Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:18 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server cloudflare vary Accept-Encoding access-control-allow-methods GET, OPTIONS content-type application/json access-control-allow-origin * cf-ray 83f9d83c3bda3603-FRA access-control-allow-headers Content-Type
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/6.10.0/	356 KB 78 KB	50ms 50ms	Script application/javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 Bh9exWOPGIwRshWljrtlEw== age 79390 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 79698 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:43:00 GMT server cloudflare etag 0x8D89735260901BC vary Accept-Encoding content-type application/javascript access-control-allow-origin * x-ms-request-id 196e3d49-701e-0078-0644-149a7b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83c9c7135df-FRA
GET H2	200	en.json Show response cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/	100 KB 24 KB	57ms 56ms	Fetch application/x-javascript	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT strict-transport-security max-age=31536000; includeSubDomains; preload age 42832 content-md5 0twb7zWjuAt4bYR0sykmNQ== content-length 24175 x-ms-lease-status unlocked last-modified Thu, 28 Dec 2023 19:57:10 GMT server cloudflare etag 0x8DC07DF2D729AA1 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 63201da5-e01e-006a-57c8-39e1ab000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83d3c79bb9d-FRA expires Thu, 04 Jan 2024 08:24:18 GMT
GET H2	200	otCenterRounded.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/	9 KB 3 KB	48ms 48ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 SH1nUCPouc1JVrHnvxpQbg== age 77844 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 2857 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:51 GMT server cloudflare etag 0x8D89735210A49EB vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id 2a091784-001e-005d-796e-0c3307000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83d9ccfbb9d-FRA
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/	45 KB 12 KB	49ms 49ms	Fetch application/json	2606:4700::6812:82ec CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT content-md5 zNsRoM1FEmsEgJoYMCNTng== age 2377 strict-transport-security max-age=31536000; includeSubDomains; preload content-length 11755 x-ms-lease-status unlocked last-modified Thu, 03 Dec 2020 02:42:53 GMT server cloudflare etag 0x8D897352245C4EA vary Accept-Encoding content-type application/json access-control-allow-origin * x-ms-request-id 77f313b5-301e-0034-7eb4-210a4b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes cf-ray 83f9d83d9cd1bb9d-FRA
GET H2	200	launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response assets.adobedtm.com/	481 KB 117 KB	125ms 39ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 5fc47d28f6738c10fe8546f3fb52b563a929f05b385370165a6655eebea2fa2a Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:18 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:40 GMT server AkamaiNetStorage etag "ea6dbbbbebcadf61231945009a1c1643:1703870980.947038" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 119627 expires Wed, 03 Jan 2024 09:24:18 GMT
GET H2	200	AppMeasurement.min.js Show response assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/	34 KB 13 KB	51ms 51ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip last-modified Tue, 12 Sep 2023 05:33:26 GMT server AkamaiNetStorage etag "208eb534ea01036a4fca64e6715ccf3f:1694496806.451282" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 12687 expires Wed, 03 Jan 2024 09:24:19 GMT
GET H2	200	AppMeasurement_Module_ActivityMap.min.js Show response assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/	3 KB 2 KB	55ms 55ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip last-modified Tue, 12 Sep 2023 05:33:26 GMT server AkamaiNetStorage etag "f1e098a5dd836ea5fc9726c429c8d71d:1694496806.740373" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control no-cache accept-ranges bytes timing-allow-origin * content-length 1597 expires Wed, 03 Jan 2024 09:24:19 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	64 KB 17 KB	155ms 39ms	Script application/javascript	23.53.42.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.fortinet.com URL: https://www.fortinet.com/blog/threat-research/bandook-persistent-threat-that-keeps-evolving Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-42-251.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 20 Dec 2023 22:26:49 GMT server nginx/1.14.0 (Ubuntu) etag "65836a29-fee9" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 17567 expires Wed, 03 Jan 2024 08:24:19 GMT
GET H2	200	RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/	358 B 484 B	44ms 44ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash ff5b07ecbb568fb465a88d1f39cf117d618f0d5a9c7bb41a3154641c2018aa2d Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:43 GMT server AkamaiNetStorage etag "e1010308eabed138a5839192538cdb8d:1703870983.942573" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 228 expires Wed, 03 Jan 2024 09:24:19 GMT
GET H2	200	RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/	2 KB 981 B	40ms 40ms	Script application/x-javascript	2a02:26f0:3500:587::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/474bf3ea7133/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash aa6f4d595eb1617102cbe3538e56decffa61bb72c7713509470b363923413625 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip last-modified Fri, 29 Dec 2023 17:29:43 GMT server AkamaiNetStorage etag "e1010308eabed138a5839192538cdb8d:1703870983.942573" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin https://www.fortinet.com cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 724 expires Wed, 03 Jan 2024 09:24:19 GMT
GET H2	200	optOutStatus Show response dpm.demdex.net/	41 B 542 B	175ms 58ms	XHR application/json	54.77.74.34 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/optOutStatus?d_visid_ver=5.5.0&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1704270259284 Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.77.74.34 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-77-74-34.eu-west-1.compute.amazonaws.com Software / Resource Hash e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers dcs dcs-prod-irl1-1-v054-074995c50.edge-irl1.demdex.com 2 ms pragma no-cache date Wed, 03 Jan 2024 08:24:19 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip x-tid z9EadzHgSzA= vary Origin content-type application/json;charset=utf-8 p3p policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" access-control-allow-origin https://www.fortinet.com cache-control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private access-control-allow-credentials true content-length 60 expires Thu, 01 Jan 1970 00:00:00 UTC
GET H2	200	/ Show response c.6sc.co/	7 B 194 B	41ms 40ms	XHR text/html	23.53.42.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-53-42-251.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.fortinet.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	20 B 311 B	158ms 40ms	XHR text/html	2a02:26f0:ab00::214:8e41 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e41 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 9ca5a1cdf97cb07f4a1c6d032fc4fb26ed02c8334f2baa6daf81f70b7fd0dc52 Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:19 GMT vary Origin content-type text/html access-control-allow-origin https://www.fortinet.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::10 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1704270259382_34901565_812406367_24_824_38_78_219";dur=1 content-length 20 expires Wed, 03 Jan 2024 08:24:19 GMT
GET H2	200	s29814055678546 metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/ Redirect Chain https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid=481ACCEB3BB9C44C-2A0C76CE87C1D538&ce=UTF-8&pageN... https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&pccr=true&vidn=32CA8CD984BD29B0-40001069405B0A03&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid...	43 B 249 B	52ms 52ms	Image image/gif	63.140.62.108 OMNITURE
General Check archive.org Show headers Download Go to Show image Full URL https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&pccr=true&vidn=32CA8CD984BD29B0-40001069405B0A03&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid=481ACCEB3BB9C44C-2A0C76CE87C1D538&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 Protocol H2 Server 63.140.62.108 , United States, ASN15224 (OMNITURE, US), Reverse DNS ip-63-140-62-108.data.adobedc.net Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.fortinet.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers pragma no-cache date Wed, 03 Jan 2024 08:24:19 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Thu, 04 Jan 2024 08:24:19 GMT server jag etag 3659892514990948352-4617991889952402104 vary * p3p CP="This is not a P3P policy" access-control-allow-origin * content-type image/gif;charset=utf-8 cache-control no-cache, no-store, max-age=0, no-transform, private content-length 43 x-xss-protection 1; mode=block expires Tue, 02 Jan 2024 08:24:19 GMT Redirect headers pragma no-cache date Wed, 03 Jan 2024 08:24:19 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff last-modified Thu, 04 Jan 2024 08:24:19 GMT server jag vary Origin p3p CP="This is not a P3P policy" access-control-allow-origin * location https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s29814055678546?AQB=1&pccr=true&vidn=32CA8CD984BD29B0-40001069405B0A03&ndh=1&pf=1&t=3%2F0%2F2024%209%3A24%3A19%203%20-60&fid=481ACCEB3BB9C44C-2A0C76CE87C1D538&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Abandook-persistent-threat-that-keeps-evolving&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fbandook-persistent-threat-that-keeps-evolving&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 content-type text/plain;charset=utf-8 cache-control no-cache, no-store, max-age=0, no-transform, private content-length 0 x-xss-protection 1; mode=block expires Tue, 02 Jan 2024 08:24:19 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	726 B 674 B	127ms 47ms	XHR application/json	18.184.137.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.137.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-137-169.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 4af0af54f335975e4e3c704829ee7882427fd49a71b43206306e8c84949a7b73 Request headers Referer https://www.fortinet.com/ accept-language de-DE,de;q=0.9 Authorization Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 X-6s-CustomID WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36 Response headers date Wed, 03 Jan 2024 08:24:19 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.fortinet.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 389
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	123ms 42ms	Preflight	18.184.137.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.184.137.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-184-137-169.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.fortinet.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.fortinet.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Wed, 03 Jan 2024 08:24:19 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a