HTTP/1.1 200 OK
Content-Length: 4612
Connection: close
Cache-Control: no-cache
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=8; IE=EDGE">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://fonts.googleapis.com/css?family=Roboto&display=swap" rel="stylesheet">
<style type="text/css">
body {
height: 100%;
font-family: Roboto, Helvetica, Arial, sans-serif;
color: #6a6a6a;
margin: 0;
display: flex;
align-items: center;
justify-content: center;
}
input[type=date], input[type=email], input[type=number], input[type=password], input[type=search], input[type=tel], input[type=text], input[type=time], input[type=url], select, textarea {
color: #262626;
vertical-align: baseline;
margin: .2em;
border-style: solid;
border-width: 1px;
border-color: #a9a9a9;
background-color: #fff;
box-sizing: border-box;
padding: 2px .5em;
appearance: none;
border-radius: 0;
}
input:focus {
border-color: #646464;
box-shadow: 0 0 1px 0 #a2a2a2;
outline: 0;
}
button {
padding: .5em 1em;
border: 1px solid;
border-radius: 3px;
min-width: 6em;
font-weight: 400;
font-size: .8em;
cursor: pointer;
}
button.primary {
color: #fff;
background-color: rgb(47, 113, 178);
border-color: rgb(34, 103, 173);
}
.message-container {
height: 500px;
width: 600px;
padding: 0;
margin: 10px;
}
.logo {
background: url(https://<ip>:50050/XX/YY/ZZ/CI/MGPGHGPGPFGHDDPFGGHGFHBGCHEGPFBGAHAH) no-repeat left center;
height: 267px;
object-fit: contain;
}
table {
background-color: #fff;
border-spacing: 0;
margin: 1em;
}
table > tbody > tr > td:first-of-type:not([colspan]) {
white-space: nowrap;
color: rgba(0,0,0,.5);
}
table > tbody > tr > td:first-of-type {
vertical-align: top;
}
table > tbody > tr > td {
padding: .3em .3em;
}
.field {
display: table-row;
}
.field > :first-child {
display: table-cell;
width: 20%;
}
.field.single > :first-child {
display: inline;
}
.field > :not(:first-child) {
width: auto;
max-width: 100%;
display: inline-flex;
align-items: baseline;
virtical-align: top;
box-sizing: border-box;
margin: .3em;
}
.field > :not(:first-child) > input {
width: 230px;
}
.form-footer {
display: inline-flex;
justify-content: flex-start;
}
.form-footer > * {
margin: 1em;
}
.text-scrollable {
overflow: auto;
height: 150px;
border: 1px solid rgb(200, 200, 200);
padding: 5px;
font-size: 1em;
}
.text-centered {
text-align: center;
}
.text-container {
margin: 1em 1.5em;
}
.flex-container {
display: flex;
}
.flex-container.column {
flex-direction: column;
}
</style>
<title>Web Filter Block Override</title>
</head>
<body><div class="message-container">
<div class="logo"></div>
<h1>FortiGuard Intrusion Prevention - Access Blocked</h1>
<h3>Web Filter Block Override</h3>
<p>Please contact your administrator to gain access to the web page.</p>
<div><font color="#FF0000">Invalid FortiGuard Web Filtering override request.</font></div>
</div></body>
</html>
{
"@category" : "datascan",
"@timestamp" : "2024-11-06T10:39:51.000Z",
"app" : {
"extract" : {
"domain" : [
"googleapis.com"
],
"hostname" : [
"fonts.googleapis.com"
],
"url" : [
"https://fonts.googleapis.com/css?family=Roboto&display=swap"
]
},
"http" : {
"bodymd5" : "78ef50daf46f0d2e957e772aead46747",
"bodymmh3" : -705868530,
"component" : [
{
"productvendor" : "Fortinet",
"product" : "FortiGuard"
}
],
"headermd5" : "257fdf67bf182740586db7f7fc5f5223",
"headermmh3" : 1740361275,
"title" : "Web Filter Block Override"
},
"length" : 4871
},
"asn" : "AS8100",
"basicconstraints" : "critical",
"ca" : "false",
"city" : "Los Angeles",
"country" : "US",
"cpe" : "<enterprise field>: cpe",
"cpecount" : "<enterprise field>: cpecount",
"data" : "HTTP/1.1 200 OK\r\nContent-Length: 4612\r\nConnection: close\r\nCache-Control: no-cache\r\nContent-Type: text/html; charset=utf-8\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1; mode=block\r\nX-Content-Type-Options: nosniff\r\nContent-Security-Policy: frame-ancestors 'self'\r\n\r\n<!DOCTYPE html>\n<html lang=\"en\">\n <head>\n <meta charset=\"UTF-8\">\n <meta http-equiv=\"X-UA-Compatible\" content=\"IE=8; IE=EDGE\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <link href=\"https://fonts.googleapis.com/css?family=Roboto&display=swap\" rel=\"stylesheet\">\n <style type=\"text/css\">\n body {\n height: 100%;\n font-family: Roboto, Helvetica, Arial, sans-serif;\n color: #6a6a6a;\n margin: 0;\n display: flex;\n align-items: center;\n justify-content: center;\n }\n input[type=date], input[type=email], input[type=number], input[type=password], input[type=search], input[type=tel], input[type=text], input[type=time], input[type=url], select, textarea {\n color: #262626;\n vertical-align: baseline;\n margin: .2em;\n border-style: solid;\n border-width: 1px;\n border-color: #a9a9a9;\n background-color: #fff;\n box-sizing: border-box;\n padding: 2px .5em;\n appearance: none;\n border-radius: 0;\n }\n input:focus {\n border-color: #646464;\n box-shadow: 0 0 1px 0 #a2a2a2;\n outline: 0;\n }\n button {\n padding: .5em 1em;\n border: 1px solid;\n border-radius: 3px;\n min-width: 6em;\n font-weight: 400;\n font-size: .8em;\n cursor: pointer;\n }\n button.primary {\n color: #fff;\n background-color: rgb(47, 113, 178);\n border-color: rgb(34, 103, 173);\n }\n .message-container {\n height: 500px;\n width: 600px;\n padding: 0;\n margin: 10px;\n }\n .logo {\n background: url(https://<ip>:50050/XX/YY/ZZ/CI/MGPGHGPGPFGHDDPFGGHGFHBGCHEGPFBGAHAH) no-repeat left center;\n height: 267px;\n object-fit: contain;\n }\n table {\n background-color: #fff;\n border-spacing: 0;\n margin: 1em;\n }\n table > tbody > tr > td:first-of-type:not([colspan]) {\n white-space: nowrap;\n color: rgba(0,0,0,.5);\n }\n table > tbody > tr > td:first-of-type {\n vertical-align: top;\n }\n table > tbody > tr > td {\n padding: .3em .3em;\n }\n .field {\n display: table-row;\n }\n .field > :first-child {\n display: table-cell;\n width: 20%;\n }\n .field.single > :first-child {\n display: inline;\n }\n .field > :not(:first-child) {\n width: auto;\n max-width: 100%;\n display: inline-flex;\n align-items: baseline;\n virtical-align: top;\n box-sizing: border-box;\n margin: .3em;\n }\n .field > :not(:first-child) > input {\n width: 230px;\n }\n .form-footer {\n display: inline-flex;\n justify-content: flex-start;\n }\n .form-footer > * {\n margin: 1em;\n }\n .text-scrollable {\n overflow: auto;\n height: 150px;\n border: 1px solid rgb(200, 200, 200);\n padding: 5px;\n font-size: 1em;\n }\n .text-centered {\n text-align: center;\n }\n .text-container {\n margin: 1em 1.5em;\n }\n .flex-container {\n display: flex;\n }\n .flex-container.column {\n flex-direction: column;\n }\n </style>\n <title>Web Filter Block Override</title>\n </head>\n <body><div class=\"message-container\">\n <div class=\"logo\"></div>\n <h1>FortiGuard Intrusion Prevention - Access Blocked</h1>\n <h3>Web Filter Block Override</h3>\n <p>Please contact your administrator to gain access to the web page.</p>\n <div><font color=\"#FF0000\">Invalid FortiGuard Web Filtering override request.</font></div>\n</div></body>\n</html>\n",
"datamd5" : "8c5dea55014041486385925b4920aa63",
"datammh3" : -1340328350,
"device" : {
"class" : "<enterprise field>: device.class",
"product" : "<enterprise field>: device.product",
"productvendor" : "<enterprise field>: device.productvendor",
"productversion" : "<enterprise field>: device.productversion"
},
"domain" : [
"quadranet.com"
],
"fingerprint" : {
"md5" : "ded2c5c1aff5e7f9cbdc4d99d262a25d",
"sha1" : "778a2497598bdf675807b07fcf0c6f650493d0a9",
"sha256" : "468ae02ec30a144bc00872a955fa6f4b5bfc9d5f4ca50746cb5fea2f8e8c18ae"
},
"geolocus" : {
"asn" : "AS8100",
"continent" : "NA",
"continentname" : "North America",
"country" : "US",
"countryname" : "United States",
"domain" : [
"quadranet.com"
],
"isineu" : "false",
"latitude" : "37.09024",
"location" : "37.09024,-95.712891",
"longitude" : "-95.712891",
"netname" : "QUADRANET",
"organization" : "QuadraNet Enterprises LLC",
"subnet" : "155.94.192.0/20"
},
"host" : [
"unassigned"
],
"hostname" : [
"unassigned.quadranet.com"
],
"ip" : "155.94.192.118",
"ipv6" : "false",
"issuer" : {
"city" : "Sunnyvale",
"commonname" : "support",
"country" : "US",
"email" : "support@fortinet.com",
"organization" : "Fortinet",
"organizationalunit" : "Certificate Authority"
},
"latitude" : "34.0726",
"location" : "34.0726,-118.2610",
"longitude" : "-118.2610",
"node" : {
"country" : "<enterprise field>: node.country",
"groupid" : "<enterprise field>: node.groupid",
"id" : "<enterprise field>: node.id",
"physicalcountry" : "<enterprise field>: node.physicalcountry"
},
"organization" : "ASN-QUADRANET-GLOBAL",
"os" : "FortiOS",
"osvendor" : "Fortinet",
"port" : 50050,
"protocol" : "http",
"protocolversion" : "1.1",
"publickey" : {
"algorithm" : "rsaEncryption",
"length" : 2048
},
"reason" : "OK",
"reverse" : [
"unassigned.quadranet.com"
],
"seen_date" : "2024-11-06",
"serial" : "7a:f3:2f:7f:64:40:f5:89:a3:11:ef:c7:f0:49:6a:1f:b3:e4:3b:77",
"signature" : {
"algorithm" : "sha256WithRSAEncryption"
},
"source" : "datascan",
"status" : 200,
"subject" : {
"city" : "Sunnyvale",
"commonname" : "FGT30E5611209064",
"country" : "US",
"email" : "support@fortinet.com",
"organization" : "Fortinet",
"organizationalunit" : "FortiGate"
},
"subnet" : "155.94.192.0/23",
"tag" : "<enterprise field>: tag",
"tld" : [
"com"
],
"tls" : "true",
"transport" : "tcp",
"url" : "/",
"validity" : {
"notafter" : "2026-06-08T11:06:01Z",
"notbefore" : "2024-03-05T11:06:01Z"
},
"version" : "v3",
"wildcard" : "false"
}
