www.fortinet.com Open in urlscan Pro
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.fortinet.com/blog/threat-research/tictactoe-dropper
Submission: On February 15 via api (February 15th 2024, 5:29:34 am UTC) from TR — Scanned from DE

Summary HTTP 45 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 7 domains to perform 45 HTTP transactions. The main IP is 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is www.fortinet.com. The Cisco Umbrella rank of the primary domain is 158391.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 5th 2023. Valid for: a year.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	2a05:d014:f3c... 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:82ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a02:26f0:350... 2a02:26f0:3500:587::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	95.101.111.170 95.101.111.170	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	52.31.21.131 52.31.21.131	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e70	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	63.140.62.17 63.140.62.17	15224 (OMNITURE) (OMNITURE)
2	35.157.191.111 35.157.191.111	16509 (AMAZON-02) (AMAZON-02)
45	10

26 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:3500:587::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.111.170 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-170.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.31.21.131 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-21-131.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:ab00::214:8e70 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.62.17 (United States) 1 redirects

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-17.data.adobedc.net

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.191.111 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-191-111.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
28	fortinet.com 1 redirects www.fortinet.com — Cisco Umbrella Rank: 158391 metrics.fortinet.com — Cisco Umbrella Rank: 334324	5 MB
6	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 378	126 KB
5	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 438	133 KB
3	6sc.co j.6sc.co — Cisco Umbrella Rank: 6461 c.6sc.co — Cisco Umbrella Rank: 9771 ipv6.6sc.co — Cisco Umbrella Rank: 6648	18 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 11323	708 B
1	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 250	542 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 612	305 B
45	7

	Domain	Requested by
26	www.fortinet.com	www.fortinet.com
6	cdn.cookielaw.org	www.fortinet.com cdn.cookielaw.org
5	assets.adobedtm.com	cdn.cookielaw.org assets.adobedtm.com
2	epsilon.6sense.com	j.6sc.co
2	metrics.fortinet.com	1 redirects
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	dpm.demdex.net	assets.adobedtm.com
1	j.6sc.co	www.fortinet.com
1	geolocation.onetrust.com	cdn.cookielaw.org
45	10

This site contains links to these domains. Also see Links.

Domain
github.com
www.red-gate.com
horsicq.github.io
blogs.blackberry.com
www.jaiminton.com
www.virustotal.com
www.linkedin.com
www.twitter.com
www.youtube.com
www.instagram.com
www.facebook.com
fortiguard.com
community.fortinet.com
investor.fortinet.com
onetrust.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-05` - `2024-08-04`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
Frame ID: 6204240DB7BF2A07DF704EAAAE473CC1
Requests: 46 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TicTacToe Dropper | FortiGuard LabsBack ButtonFilter Button

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/
/etc\.clientlibs/

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Page Statistics

45
Requests

98 %
HTTPS

56 %
IPv6

7
Domains

10
Subdomains

10
IPs

3
Countries

5703 kB
Transfer

7273 kB
Size

11
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/de4dot/de4dot
Title: de4dot tool

Search URL Search Domain Scan URL

URL: https://www.red-gate.com/products/smartassembly/
Title: SmartAssembly

Search URL Search Domain Scan URL

URL: https://horsicq.github.io/
Title: Detect It Easy

Search URL Search Domain Scan URL

URL: https://blogs.blackberry.com/en/2019/03/blackberry-cylance-vs-tinba-banking-trojan
Title: also known as

Search URL Search Domain Scan URL

URL: https://www.jaiminton.com/reverse-engineering/remcos
Title: malware analysis report

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/gui/collection/a5a5b60edcbbb203cb1965b1d544b74c47284e015ffd50312de0a251141bfbd7/iocs
Title: https://www.virustotal.com/gui/collection/a5a5b60edcbbb203cb1965b1d544b74c47284e015ffd50312de0a251141bfbd7/iocs

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCJHo4AuVomwMRzgkA5DQEOA?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.instagram.com/fortinet/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://community.fortinet.com/
Title: Fortinet Community

Search URL Search Domain Scan URL

URL: https://investor.fortinet.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fid=5CAEE1FCF1497339-129966DA3D0A6FB5&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Atictactoe-dropper&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Atictactoe-dropper&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&pccr=true&vidn=32E6D09D67D450EA-60000EC380011DF9&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fid=5CAEE1FCF1497339-129966DA3D0A6FB5&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Atictactoe-dropper&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Atictactoe-dropper&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

45 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request tictactoe-dropper Show response
www.fortinet.com/blog/threat-research/ 65 KB
21 KB 461ms
45ms Document
text/html 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

584d9542a74236139896881ae837721b3514f2478f5d5acce59828ac0c987866

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 48468
Cache-Control: max-age=600, public, s-maxage=10800
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 20221
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Type: text/html;charset=utf-8
Date: Thu, 15 Feb 2024 05:26:02 GMT
ETag: "1029f-61159a05eab07-gzip"
Last-Modified: Wed, 14 Feb 2024 16:01:40 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BIUIxdbx-z0ho_wyQSqnfyxIDxbKulOnsaQn5YhoLHn-f_D9qacYzw==
X-Amz-Cf-Pop: FRA60-P3
X-Cache: Hit from cloudfront
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK at.js Show response
www.fortinet.com/etc/designs/fortinet/adb-target/ 104 KB
48 KB 124ms
44ms Script
application/javascript 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 15 Feb 2024 05:20:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Encoding: gzip
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
X-Vhost: publish
X-Cache: Hit from cloudfront
Age: 4960262
Connection: keep-alive
Content-Length: 47782
X-XSS-Protection: 1; mode=block
Last-Modified: Fri, 31 Mar 2023 18:09:20 GMT
Server: Apache
ETag: "19e83-5f8361bb01400-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: VnBrNljlwV0sXTRxr1X8TOBYQGGiJ0bdJGcO2cjfK8OvfmUnDhlJNg==

GET
H/1.1 200
OK clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 540 KB
28 KB 78ms
42ms Stylesheet
text/css 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 07 Feb 2024 10:30:33 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Encoding: gzip
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
X-Vhost: publish
X-Cache: Hit from cloudfront
Age: 673135
Connection: keep-alive
Content-Length: 27479
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 17 Jan 2024 23:26:38 GMT
Server: Apache
ETag: "86e18-60f2c941a6780-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 9yURetQ4N5h0jiDfpKnxXz_2E4F70IHTCcjSxxFgPQl2LWvJvs36Nw==

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 134ms
51ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be2dfa172d505acb197760b55c4731347cc239a7a046013c251948bb8214dbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: jEXNH7qItSS8Y+G7eM2k2w==
age: 10564
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6841
x-ms-lease-status: unlocked
last-modified: Wed, 14 Feb 2024 03:39:00 GMT
server: cloudflare
etag: 0x8DC2D0E7BAD4130
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 6b2ce26c-701e-0057-1111-5f97b0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b274479865d69-FRA

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 163ms
44ms Image
image/svg+xml 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 15 Feb 2024 04:33:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Encoding: gzip
Via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
X-Vhost: publish
X-Cache: Hit from cloudfront
Age: 3357
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Content-Length: 1998
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
ETag: "7ebb-565d53a1d6e40-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: KEFjF7krmHo24Ci599h5SUfouEimX7Pi6gGRcS3rmxWMYHZz3RzO5Q==

GET
H/1.1 200
OK toc-icon.jpg
www.fortinet.com/content/dam/fortinet/images/ 1 KB
3 KB 619ms
499ms Image
image/jpeg 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet/images/toc-icon.jpg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 15 Feb 2024 05:29:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 7991705
X-Vhost: publish
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 1277
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 14 Nov 2023 17:34:13 GMT
Server: Apache
ETag: "4fd-60a2031eb4f40"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: YGcRIkq1C0vUHJkN6HQ_cV8DvnQoP42wTovY84eiVPZDKFTvJXV2-g==

GET
H/1.1 200
OK clientlib-base.min.45f6c0bdb03736a410d54befc06568ae.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 156 KB
73 KB 45ms
45ms Script
application/javascript 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.45f6c0bdb03736a410d54befc06568ae.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

f95b62f026ed0d8161a753024fcd4e7c5f8677feb314645900ea53e1a832174b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 12 Feb 2024 07:23:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Encoding: gzip
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
X-Vhost: publish
X-Cache: Hit from cloudfront
Age: 252384
Connection: keep-alive
Content-Length: 72950
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 01 Feb 2024 21:53:13 GMT
Server: Apache
ETag: "2709b-6105905a38440-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: sHD2LwAhr2ryM2nsgPRjZimrIi0UI19FbS93WLossBOqd6DJiuLUSQ==

GET
H2 200 f85f39fc-d7aa-467a-b762-fbb722748016.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/ 5 KB
2 KB 138ms
59ms XHR
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/f85f39fc-d7aa-467a-b762-fbb722748016.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 23462
content-md5: Uj3iBUKm1Vl2g2NHq67V+w==
content-length: 1792
x-ms-lease-status: unlocked
last-modified: Thu, 28 Dec 2023 19:56:54 GMT
server: cloudflare
etag: 0x8DC07DF23DF5130
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 67257c4e-101e-0033-60c8-396628000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b27455afb1e55-FRA
expires: Fri, 16 Feb 2024 05:29:29 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 49ms
49ms Image
image/svg+xml 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Thu, 15 Feb 2024 04:33:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Content-Encoding: gzip
Via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
X-Vhost: publish
X-Cache: Hit from cloudfront
Age: 3357
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Content-Length: 1998
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
ETag: "7ebb-565d53a1d6e40-gzip"
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: GrUTohpKRdJ0jf8oTeBm1HJ2_tUucB5P1_gouUektciDnwpUZR18Iw==

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK tictactoe-dropper-hero.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 340 KB
341 KB 45ms
44ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/tictactoe-dropper-hero.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

19f83873e2ac30a83bd96bc2f6de57e3c07c223eb87d23c8fa234d3ca753bb4a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 16:26:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 47564
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 347917
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:42:15 GMT
Server: Apache
ETag: "54f0d-610ba19518bc0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: pvNdIdARdTY48KqVOKGdyLhUsDs-RInGoX_FHSCs7RrqXmDUa1rKqA==

GET
H/1.1 200
OK py-infostealer-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 52 KB
53 KB 73ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/py-infostealer-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

7fe429c690a3a8b602a0ad11342b63ff53e6aa2fda49144f2ad18a4603a8a4d8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 16:19:00 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 53286
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 31 Jan 2024 17:38:34 GMT
Server: Apache
ETag: "d026-6104159191a80"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: kmYYQm01mumbPB2QO3drhkpFedEpYmA6oPUMyO2aOgxCXf309pZD2w==

GET
H/1.1 200
OK exelastealer-thumbnail.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-heros/ 52 KB
53 KB 46ms
42ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-heros/exelastealer-thumbnail.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

2d1dc28b1014597eab93a1ea92bb45ffef29c56f4368e92566c08a1249947e64

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 15 Feb 2024 05:24:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 7426286
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 52957
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 17 Oct 2023 17:49:00 GMT
Server: Apache
ETag: "cedd-607ed233b5b00"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: n5MWhtY0oahgTTedHewWnAKHNKl23NylgZkB3CbOVT71_8CoFCEIaQ==

GET
H/1.1 200
OK thirdeye-THUMB.jpg.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/ 124 KB
125 KB 80ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/thirdeye-THUMB.jpg.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a2160f878cee16add97b8d42f7125cc281f3d84550c0039a806aba0cff27824b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Thu, 15 Feb 2024 05:24:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 15154591
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 126989
X-XSS-Protection: 1; mode=block
Last-Modified: Fri, 16 Jun 2023 20:39:21 GMT
Server: Apache
ETag: "1f00d-5fe452df85040"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: XWbWWQV1WPtoK-n-FtKFDghkZVzJ-9D2FTsG580tjge3xIConiSWVA==

GET
H/1.1 200
OK UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
www.fortinet.com/etc/designs/fortinet/gfonts/ 37 KB
38 KB 51ms
41ms Font
application/octet-stream 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc/designs/fortinet/gfonts/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.dd0a483149c256850fa49d2e21abf149.css
Origin: https://www.fortinet.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Sun, 04 Feb 2024 12:10:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 926360
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 37716
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 18 May 2022 21:08:06 GMT
Server: Apache
ETag: "9354-5df4fa74ff980"
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Cache-Control: max-age=2000000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: bIHwbG67VkvXqgK0NoXszBTkW1edxeKjEchCSi5A8hR2LlO8AmKoGw==

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK fig01-tictactoe-dropper-extraction-process.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1707240630072/ 77 KB
78 KB 89ms
44ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image.img.png/1707240630072/fig01-tictactoe-dropper-extraction-process.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

394c60108835df9b3ce1299be2953e91664fb678a6da1974d7322ca3213aaf08

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:07:44 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48329
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 78730
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:30:30 GMT
Server: Apache
ETag: "1338a-610b9ef4c1980"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: oEIvEzCyI1KicCzS9PO_r_1PVZsKe_9jhl-sxnQzVvpYDQetri4q7A==

GET
H/1.1 200
OK fig02-tictactoe-dropper-final-payload-timeline-2023.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_769488100.img.png/1707240647167/ 104 KB
105 KB 42ms
42ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_769488100.img.png/1707240647167/fig02-tictactoe-dropper-final-payload-timeline-2023.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

20c833eec768227ffdd358ddbfb7c8dedd6b2fc656108e0e72e2687a0a17df72

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 17:13:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 106657
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:30:47 GMT
Server: Apache
ETag: "1a0a1-610b9f04f7fc0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: bAp6O_2afFu9iX_MRLj59pbpFcbRUjalVmrI1yjkvCFaRVcgmBa0jg==

GET
H/1.1 200
OK fig03-tictactoe-dropper-extracting-pe-dll-file-from-dropper-exe-in-tool-dnspy.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_5344558.img.png/1707240681891/ 350 KB
351 KB 42ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_5344558.img.png/1707240681891/fig03-tictactoe-dropper-extracting-pe-dll-file-from-dropper-exe-in-tool-dnspy.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

730985f3d2888ea66f3657fb12ef311e72625ef23fe8cf9129d96ea2b098127f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 23:07:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 358289
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:31:21 GMT
Server: Apache
ETag: "57791-610b9f2564c40"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 4tU6icO52Mknbz85aGCWC_8EHlKQC1VFmtPN-KSNE5J4JxZytmYX9Q==

GET
H/1.1 200
OK fig04-tictactoe-dropper-obfuscated-code-hadval-shown-dnspy-tool.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1548124602.img.png/1707240697342/ 376 KB
377 KB 45ms
44ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1548124602.img.png/1707240697342/fig04-tictactoe-dropper-obfuscated-code-hadval-shown-dnspy-tool.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ab9b5fa5e5b4087fde9c0da3a1a7c0c8c8d6024fe662b68081d7dada8237e8df

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 23:07:52 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 385118
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:31:37 GMT
Server: Apache
ETag: "5e05e-610b9f34a7040"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: GvqQN9G5i4qXCGT5icPqow-fN1_YwaGrJgNBZ5jMHtepKKrrMlkRDA==

GET
H/1.1 200
OK fig05-de-obfuscating-intermediate-payload-hadval.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2008577996.img.png/1707240711681/ 92 KB
94 KB 42ms
42ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2008577996.img.png/1707240711681/fig05-de-obfuscating-intermediate-payload-hadval.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

d8d5ca28ab8deaebed1e4f87251854107a966285e5db41c9f863f5ecf19b095e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 17:13:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 94423
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:31:51 GMT
Server: Apache
ETag: "170d7-610b9f4200fc0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: Oo_JWKAqmDh0ChbmJI4Kmiql4BtqXXgCDM_hTSqaP30Xfkh7u6g6bw==

GET
H/1.1 200
OK fig06-tictactoe-dropper-cleaned-code-hadval-open-dnspy-tool.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1335245918.img.png/1707240729492/ 332 KB
334 KB 41ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1335245918.img.png/1707240729492/fig06-tictactoe-dropper-cleaned-code-hadval-open-dnspy-tool.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

4ce1398c0d4319698dad45eb9cb9f0c0f519d46c16044d544213975c971cb7fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 23:07:57 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48115
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 340169
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:32:09 GMT
Server: Apache
ETag: "530c9-610b9f532b840"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: ocRrRQGIYSlrHd5pJPwvJhQIZ6BdAC0dxtjd9CBQ9p47qP0Z12Aqiw==

GET
H/1.1 200
OK fig07-tictactoe-dropper-stage-3-protected-payload.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1470117724.img.png/1707240756976/ 124 KB
126 KB 42ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1470117724.img.png/1707240756976/fig07-tictactoe-dropper-stage-3-protected-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

ee14917731097eacf04a1b9cd44aa5c19905e12c51666d6776764723558fd33f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Wed, 14 Feb 2024 17:13:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 127333
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:32:36 GMT
Server: Apache
ETag: "1f165-610b9f6ceb500"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: MVkQZNTtTlmlC7bIWwvPL8HEJctmL818s5K3yzlbWduaMivGfZWiGw==

GET
H/1.1 200
OK fig08-tictactoe-dropper-decrypted-code-stage-3-payload.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2145466511.img.png/1707240772208/ 310 KB
311 KB 41ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2145466511.img.png/1707240772208/fig08-tictactoe-dropper-decrypted-code-stage-3-payload.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

74d340ef03ae31f8f079b7fcaef56d5f8ed4853cdbbaa36aa53c40f37f249528

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 17:13:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 47705
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 316987
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:32:52 GMT
Server: Apache
ETag: "4d63b-610b9f7c2d900"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: AkhIV8wCGB8QiGn0JqHAOZKxZXtLdr0UtqLHccWubl7Bixocb_C0nA==

GET
H/1.1 200
OK fig09-tictactoe-dropper-sample-showing-loading-code-resource-object.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1825867991.img.png/1707240792058/ 344 KB
345 KB 42ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1825867991.img.png/1707240792058/fig09-tictactoe-dropper-sample-showing-loading-code-resource-object.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

c0e8f67c8b2339200bbbda7b1e08c7cb62a8baffe4fa342db962089d8aeabc40

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48328
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 352383
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:33:12 GMT
Server: Apache
ETag: "5607f-610b9f8f40600"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: -y28UkqmRFuFiSubj_x5-CdFDtkeVRhSXgw879Rbu_Q8S76HsdKi6w==

GET
H/1.1 200
OK fig10-tictactoe-dropper-obfuscated-code-stored-resource-object-net-executeable.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1731710561.img.png/1707240811076/ 130 KB
131 KB 41ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_1731710561.img.png/1707240811076/fig10-tictactoe-dropper-obfuscated-code-stored-resource-object-net-executeable.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

a3517b0478112e0243753f3b8f27bfcd201065e3be2bb5e8485151cc8e40d07a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:10 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48328
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 132908
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:33:31 GMT
Server: Apache
ETag: "2072c-610b9fa15f0c0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: lGW7wog7UjH7GSdoSfcNvRAWIdWekEGK0N2mBM-sXPxItaHdSdXQWQ==

GET
H/1.1 200
OK fig11-tictactoe-dropper-similarity-between-obfuscated-image-objects.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_283742395.img.png/1707240830426/ 729 KB
730 KB 44ms
44ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_283742395.img.png/1707240830426/fig11-tictactoe-dropper-similarity-between-obfuscated-image-objects.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e2a995995d7b600649a2eeeb1cd9439d3a3a068f838178c63248263f824ca7bf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48328
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 745984
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:33:50 GMT
Server: Apache
ETag: "b6200-610b9fb37db80"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: FFZ0PxDRZ6841pLJPbv3aEatfJmVIYbYfB3z6r5g9b-JfvvnQor70Q==

GET
H/1.1 200
OK fig12-tictactoe-dropper-sample-ojxu-obfuscated-code-extracted-from-resource-object.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_33771334.img.png/1707240853625/ 338 KB
339 KB 45ms
45ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_33771334.img.png/1707240853625/fig12-tictactoe-dropper-sample-ojxu-obfuscated-code-extracted-from-resource-object.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

fb64f74d6939fa24af9274fcf03ab3c459b1182b5912973f53518e7b98d765c9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 346275
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:34:13 GMT
Server: Apache
ETag: "548a3-610b9fc96cf40"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: uDpbU76kzl20-2UjJW92oKtaDf9FTgME-anIEOtCL52M77yTsn1zeg==

GET
H/1.1 200
OK fig13-tictactoe-dropper-resource-object-contianing-obfuscated-data.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2051674838.img.png/1707240869977/ 479 KB
480 KB 45ms
45ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_2051674838.img.png/1707240869977/fig13-tictactoe-dropper-resource-object-contianing-obfuscated-data.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

e9fde9d939629ba3280f34788da081f2acd7f0b5e6994da9f244c03ddfc7ccec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 7395d1816622756cd6753f5e1281200c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 48377
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 490647
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:34:29 GMT
Server: Apache
ETag: "77c97-610b9fd8af340"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: nnb3_MysII_WPtA-uYxXu0AWb-vUVFE3uOLW0FnrcLX3Ch0n7mHZHw==

GET
H/1.1 200
OK fig14-tictactoe-dropper-image-object-fala-malware-sample.png
www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_528076707.img.png/1707240891209/ 830 KB
831 KB 42ms
41ms Image
image/png 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/tictactoe-dropper/_jcr_content/root/responsivegrid/table_content/par/image_528076707.img.png/1707240891209/fig14-tictactoe-dropper-image-object-fala-malware-sample.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache /

Resource Hash

25eef8a48486413a4bfc51b78e29e787221ec635158e068712a8b0381ee799b5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/blog/threat-research/tictactoe-dropper
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Wed, 14 Feb 2024 23:08:24 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self' https://www.fortinet.com
Via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P3
Age: 47561
X-Vhost: publish
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 849695
X-XSS-Protection: 1; mode=block
Last-Modified: Tue, 06 Feb 2024 17:34:51 GMT
Server: Apache
ETag: "cf71f-610b9fedaa4c0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=684000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 1fkxKn9mhICk8HiWN9flGVYYO9szD3YoG9WWDLa98zUrcaB6le6lgA==

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
305 B 155ms
72ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.fortinet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 855b2746385d9b88-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.10.0/ 356 KB
78 KB 56ms
56ms Script
application/javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Bh9exWOPGIwRshWljrtlEw==
age: 13260
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 79698
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:43:00 GMT
server: cloudflare
etag: 0x8D89735260901BC
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 196e3d49-701e-0078-0644-149a7b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b2746baee5d69-FRA

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/ 100 KB
24 KB 55ms
55ms Fetch
application/x-javascript 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/f85f39fc-d7aa-467a-b762-fbb722748016/4ee482d4-0cd8-4c59-918a-90483d5b8131/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 19479
content-md5: 0twb7zWjuAt4bYR0sykmNQ==
content-length: 24175
x-ms-lease-status: unlocked
last-modified: Thu, 28 Dec 2023 19:57:10 GMT
server: cloudflare
etag: 0x8DC07DF2D729AA1
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 63201da5-e01e-006a-57c8-39e1ab000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b27475d571e55-FRA
expires: Fri, 16 Feb 2024 05:29:29 GMT

GET
H2 200 otCenterRounded.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/ 9 KB
3 KB 61ms
61ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/otCenterRounded.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: SH1nUCPouc1JVrHnvxpQbg==
age: 60425
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2857
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:42:51 GMT
server: cloudflare
etag: 0x8D89735210A49EB
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 2a091784-001e-005d-796e-0c3307000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b2747cdc51e55-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/ 45 KB
12 KB 56ms
56ms Fetch
application/json 2606:4700::6812:82ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.10.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: zNsRoM1FEmsEgJoYMCNTng==
age: 73459
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 11755
x-ms-lease-status: unlocked
last-modified: Thu, 03 Dec 2020 02:42:53 GMT
server: cloudflare
etag: 0x8D897352245C4EA
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 77f313b5-301e-0034-7eb4-210a4b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 855b2747cdcb1e55-FRA

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 484 KB
117 KB 119ms
39ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.10.0/otBannerSdk.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9f3926ab310964dd66ccf1185dae142e8a17c86fabcecde4f9e7ae7f0a51b9dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
last-modified: Mon, 12 Feb 2024 21:23:54 GMT
server: AkamaiNetStorage
etag: "82c5837b7d8a762f2717b982f1c3c23c:1707773034.365644"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 119620
expires: Thu, 15 Feb 2024 06:29:29 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 34 KB
13 KB 40ms
39ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
last-modified: Tue, 12 Sep 2023 05:33:26 GMT
server: AkamaiNetStorage
etag: "208eb534ea01036a4fca64e6715ccf3f:1694496806.451282"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12687
expires: Thu, 15 Feb 2024 06:29:29 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 3 KB
2 KB 44ms
43ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
last-modified: Tue, 12 Sep 2023 05:33:26 GMT
server: AkamaiNetStorage
etag: "f1e098a5dd836ea5fc9726c429c8d71d:1694496806.740373"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Thu, 15 Feb 2024 06:29:29 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 182ms
40ms Script
application/javascript 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-170.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Feb 2024 05:29:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Thu, 15 Feb 2024 05:29:30 GMT

GET
H2 200 RC448863e9e05a4b4880daa4a5fb7da328-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9a0d42827e53/ 358 B
484 B 39ms
39ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9a0d42827e53/RC448863e9e05a4b4880daa4a5fb7da328-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0d48d865a885f13603d2f069f30be6cf44f13f5f47c675434582e9d279a40dda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:29 GMT
content-encoding: gzip
last-modified: Mon, 12 Feb 2024 21:23:57 GMT
server: AkamaiNetStorage
etag: "5320ab42f9e31aca1127424e3b3310f0:1707773037.507006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 228
expires: Thu, 15 Feb 2024 06:29:29 GMT

GET
H2 200 optOutStatus Show response
dpm.demdex.net/ 41 B
542 B 191ms
60ms XHR
application/json 52.31.21.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/optOutStatus?d_visid_ver=5.5.0&d_rtbd=json&d_ver=2&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1707974970034

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.31.21.131 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-21-131.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-irl1-1-v055-05818498d.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Thu, 15 Feb 2024 05:29:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: B0IacX5DSHA=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 60
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 47ms
39ms XHR
text/html 95.101.111.170
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-170.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:30 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.fortinet.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 20 B
310 B 184ms
41ms XHR
text/html 2a02:26f0:ab00::214:8e70
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: bfd3189d965573e36997f170667b1ceef5cfd0471b6f5be228ca6ac7bcb97c23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Feb 2024 05:29:30 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:1338:92::12
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707974970190_34901612_61159792_23_763_38_82_219";dur=1
content-length: 20
expires: Thu, 15 Feb 2024 05:29:30 GMT

GET
H2 200 RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9a0d42827e53/ 2 KB
981 B 43ms
42ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/9a0d42827e53/RC0ba76d5bbb984ea6a79cd6308c48dbff-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 4d023b36d5d582feea068ce76050e2a823b41f2fdecd49946f7798881361a6c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Thu, 15 Feb 2024 05:29:30 GMT
content-encoding: gzip
last-modified: Mon, 12 Feb 2024 21:23:57 GMT
server: AkamaiNetStorage
etag: "5320ab42f9e31aca1127424e3b3310f0:1707773037.507006"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 724
expires: Thu, 15 Feb 2024 06:29:30 GMT

GET
H2

200

s57527342856488
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/
Redirect Chain

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fid=5CAEE1FCF1497339-129966DA3D0A6FB5&ce=UTF-8&page...
https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&pccr=true&vidn=32E6D09D67D450EA-60000EC380011DF9&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fi...

43 B
250 B

55ms
54ms

Image
image/gif

63.140.62.17
OMNITURE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&pccr=true&vidn=32E6D09D67D450EA-60000EC380011DF9&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fid=5CAEE1FCF1497339-129966DA3D0A6FB5&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Atictactoe-dropper&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Atictactoe-dropper&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Server

63.140.62.17 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-17.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fortinet.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Feb 2024 05:29:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 16 Feb 2024 05:29:30 GMT
server: jag
etag: 3667848321366556672-4617878773399902300
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 14 Feb 2024 05:29:30 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Feb 2024 05:29:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 16 Feb 2024 05:29:30 GMT
server: jag
vary: Origin
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
location: https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.25.0-LDQM/s57527342856488?AQB=1&pccr=true&vidn=32E6D09D67D450EA-60000EC380011DF9&ndh=1&pf=1&t=15%2F1%2F2024%206%3A29%3A30%204%20-60&fid=5CAEE1FCF1497339-129966DA3D0A6FB5&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Atictactoe-dropper&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c.&cm.&ssf=1&.cm&.c&cc=USD&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Atictactoe-dropper&v35=Enabled&v92=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
content-type: text/plain;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 0
x-xss-protection: 1; mode=block
expires: Wed, 14 Feb 2024 05:29:30 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
708 B 124ms
45ms XHR
application/json 35.157.191.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.191.111 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-191-111.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

Referer: https://www.fortinet.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 7381d1d7c753fe2d8e217c3fdc44c0f17418dcc4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
X-6s-CustomID: WebTag1.0 5eeecf22b2d12a77a14639dce97b7a36

Response headers

x-trace-id: 5909886572600551393
date: Thu, 15 Feb 2024 05:29:30 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 151ms
42ms Preflight 35.157.191.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.191.111 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-191-111.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.fortinet.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.fortinet.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Thu, 15 Feb 2024 05:29:30 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 4126484982908890632

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-21 03:11:51	Name: cookiesession1 Value: 678A3E23110D067D4E5966B8DAD11C1E
www.fortinet.com/	1970-01-20 18:36:19	Name: AWSALB Value: yQ/aoiFowjTExmKLgNwcKWhGi3uAYNoLc00o5RL8FBT/5En16N067mVkjBjuqFLQWiAeGXnjFTqAnjIthN4fMXQe9I5Vo4VwErgzVz7PIwYWeXpT+7YxjKhMEg7a/9nMArGJeA8DFKajwOc5BzTHzUpkZziOrF1dmCXjhOSNwWha5nGulcQ2Dpd4MxIsZF0E0LJ9qvngl2mZT3AUnoprAQ==
www.fortinet.com/	1970-01-20 18:36:19	Name: AWSALBCORS Value: yQ/aoiFowjTExmKLgNwcKRmz04QIT+mfVbNSHbrXw8oEGhJ/0Vpv0n9h7snusMLNKfRQXuSJuGk9Iu9nZGmbyFa2T3ENj3VbrISf1GQulFXK1n3HYQ2LoiW4x8tuMKsalqek3bWET2YtQ08ZRsJE5gEHsjPbmsFm0feOvY5w9oCYkE/uv+IXxrTMivvzSW4h268/9tHrwj5g9cBa9r4QEA==
.fortinet.com/	1970-01-21 03:11:50	Name: OptanonConsent Value: isIABGlobal=false&datestamp=Thu+Feb+15+2024+06%3A29%3A29+GMT%2B0100+(Central+European+Standard+Time)&version=6.10.0&hosts=&consentId=d21dec90-80e7-4202-875e-2951db512a4e&interactionCount=0&landingPath=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
www.fortinet.com/	1970-01-20 18:27:43	Name: aa_cc Value: DE
www.fortinet.com/	1970-01-20 18:27:43	Name: aa_cn Value: DE
.fortinet.com/	1970-01-21 04:02:14	Name: s_fid Value: 5CAEE1FCF1497339-129966DA3D0A6FB5
.fortinet.com/	1970-01-20 18:26:16	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Ftictactoe-dropper
.fortinet.com/	1970-01-20 20:35:50	Name: s_getNewRepeat Value: 1707974970228-New
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-21 04:02:14	Name: s_vi Value: [CS]v1\|32E6D09D67D450EA-60000EC380011DF9[CE]

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.fortinet.com/blog/threat-research/tictactoe-dropper Message: The resource https://www.fortinet.com/etc/designs/fortinet/adb-target/at.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.fortinet.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
c.6sc.co
cdn.cookielaw.org
dpm.demdex.net
epsilon.6sense.com
geolocation.onetrust.com
ipv6.6sc.co
j.6sc.co
metrics.fortinet.com
www.fortinet.com
2606:4700:4400::6812:2089
2606:4700::6812:82ec
2a02:26f0:3500:587::1e80
2a02:26f0:ab00::214:8e70
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd
35.157.191.111
52.31.21.131
63.140.62.17
95.101.111.170
0d48d865a885f13603d2f069f30be6cf44f13f5f47c675434582e9d279a40dda
19f83873e2ac30a83bd96bc2f6de57e3c07c223eb87d23c8fa234d3ca753bb4a
20c833eec768227ffdd358ddbfb7c8dedd6b2fc656108e0e72e2687a0a17df72
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
25eef8a48486413a4bfc51b78e29e787221ec635158e068712a8b0381ee799b5
2d1dc28b1014597eab93a1ea92bb45ffef29c56f4368e92566c08a1249947e64
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
370df1cc8999c1e03fc1c5f7ced35334513d19233d1fc79d2c1c7f711361565d
394c60108835df9b3ce1299be2953e91664fb678a6da1974d7322ca3213aaf08
452ee2471448cc6b716090a014cf7fc9cc515998bda9dcc334aa073a72a591e7
46ef912a5bf1fec350dc9d14102bcf1965471f16a57a890bdc5fc06bc4404370
4ce1398c0d4319698dad45eb9cb9f0c0f519d46c16044d544213975c971cb7fd
4d023b36d5d582feea068ce76050e2a823b41f2fdecd49946f7798881361a6c8
584d9542a74236139896881ae837721b3514f2478f5d5acce59828ac0c987866
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5be2dfa172d505acb197760b55c4731347cc239a7a046013c251948bb8214dbc
6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf
730985f3d2888ea66f3657fb12ef311e72625ef23fe8cf9129d96ea2b098127f
74d340ef03ae31f8f079b7fcaef56d5f8ed4853cdbbaa36aa53c40f37f249528
7a23e0e46e16f067271bc79c92a917c13769848457d16cdf109e4dc04c687e8f
7fe429c690a3a8b602a0ad11342b63ff53e6aa2fda49144f2ad18a4603a8a4d8
8998282f5a80fff5eaafdbd457dd7a81af0cd7c8696bfe032a6aeef8fe67f99f
9f3926ab310964dd66ccf1185dae142e8a17c86fabcecde4f9e7ae7f0a51b9dd
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2160f878cee16add97b8d42f7125cc281f3d84550c0039a806aba0cff27824b
a3517b0478112e0243753f3b8f27bfcd201065e3be2bb5e8485151cc8e40d07a
ab9b5fa5e5b4087fde9c0da3a1a7c0c8c8d6024fe662b68081d7dada8237e8df
b97c99a69a6275c8f90703cd4c0864089a74fd08383a1cc75a8a4d0c2cb60cce
bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8
bf19e4cab46ebfd04a1438e21bc98c6f520c476918f71d44a96d2523fe0abec4
bfd3189d965573e36997f170667b1ceef5cfd0471b6f5be228ca6ac7bcb97c23
c0e8f67c8b2339200bbbda7b1e08c7cb62a8baffe4fa342db962089d8aeabc40
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98
d8d5ca28ab8deaebed1e4f87251854107a966285e5db41c9f863f5ecf19b095e
db058d72d7ba8ff6ed7209af23a4458c373cc78f72c81ec1df88bb5de72a0b0b
e2a995995d7b600649a2eeeb1cd9439d3a3a068f838178c63248263f824ca7bf
e5873dbdaa376d924cfa4b2ba4b1622d4e6e483866e2b7bc24ef3007ff5960e7
e9fde9d939629ba3280f34788da081f2acd7f0b5e6994da9f244c03ddfc7ccec
ee14917731097eacf04a1b9cd44aa5c19905e12c51666d6776764723558fd33f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f95b62f026ed0d8161a753024fcd4e7c5f8677feb314645900ea53e1a832174b
f9b2aaabab92d9c63930432351fa3f5aa634fcb5db31b039e23465f8b4bd5a68
fb64f74d6939fa24af9274fcf03ab3c459b1182b5912973f53518e7b98d765c9
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.fortinet.com Open in urlscan Pro 2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

45 Requests

98 %HTTPS

56 %IPv6

7 Domains

10 Subdomains

10 IPs

3 Countries

5703 kBTransfer

7273 kBSize

11 Cookies

15 Outgoing links

Redirected requests

45 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.fortinet.com Open in urlscan Pro
2a05:d014:f3c:6c02:209f:ae6c:3c6e:e3dd Public Scan

Screenshot
Live screenshot

Full Image

45
Requests

98 %
HTTPS

56 %
IPv6

7
Domains

10
Subdomains

10
IPs

3
Countries

5703 kB
Transfer

7273 kB
Size

11
Cookies

45 HTTP transactions
2 data transactions