![](/screenshots/43a39bec-6065-467f-a7c7-aeb67afca1ce.png)
www.jaiminton.com
Open in
urlscan Pro
172.67.152.236
Public Scan
Effective URL: https://www.jaiminton.com/cheatsheet/DFIR/
Submission Tags: falconsandbox
Submission: On May 28 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 16th 2024. Valid for: 3 months.
This is the only time www.jaiminton.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 20 | 172.67.152.236 172.67.152.236 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3036::6815:1b98 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:5049 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
jaiminton.com
1 redirects
www.jaiminton.com |
940 KB |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 804 |
7 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1230 |
390 KB |
21 | 3 |
Domain | Requested by | |
---|---|---|
20 | www.jaiminton.com |
1 redirects
www.jaiminton.com
static.cloudflareinsights.com |
1 | static.cloudflareinsights.com |
www.jaiminton.com
|
1 | use.fontawesome.com |
www.jaiminton.com
|
21 | 3 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
jaiminton.com GTS CA 1P5 |
2024-05-16 - 2024-08-14 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
cloudflareinsights.com GTS CA 1P5 |
2024-05-08 - 2024-08-06 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.jaiminton.com/cheatsheet/DFIR/
Frame ID: 2BDBDA7446A5796AF043A2A68153E710
Requests: 19 HTTP requests in this frame
Frame:
https://www.jaiminton.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/main.js
Frame ID: 255B4FFA2E47DE1EF0942CD37FBA2F4E
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/43a39bec-6065-467f-a7c7-aeb67afca1ce.png)
Page Title
Digital Forensics and Incident Response : Jai MintonDetected technologies
particles.js (JavaScript Graphics) ExpandDetected patterns
- /particles(?:\.min)?\.js
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
100 Outgoing links
These are links going to different origins than the main page.
Title: ☕ Buy me a coffee
Search URL Search Domain Scan URL
Title: Hack The Box
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: LinkedIN
Search URL Search Domain Scan URL
Title: GitHub
Search URL Search Domain Scan URL
Title: YouTube
Search URL Search Domain Scan URL
Title: Mastodon
Search URL Search Domain Scan URL
Title: ForensicArtifacts
Search URL Search Domain Scan URL
Title: ConvertFrom-Yaml module
Search URL Search Domain Scan URL
Title: RawCopy
Search URL Search Domain Scan URL
Title: Binalyze IREC Evidence Collector
Search URL Search Domain Scan URL
Title: Latest documentation
Search URL Search Domain Scan URL
Title: Belkasoft Live RAM Capturer
Search URL Search Domain Scan URL
Title: Infosec Institute - Memory Analysis using Redline
Search URL Search Domain Scan URL
Title: Grzegorz Tworek - 0gtweet
Search URL Search Domain Scan URL
Title: Magnet Forensics Tools
Search URL Search Domain Scan URL
Title: Magnet RAM Capture
Search URL Search Domain Scan URL
Title: Magnet Process Capture
Search URL Search Domain Scan URL
Title: Volexity Surge
Search URL Search Domain Scan URL
Title: Microsoft LiveKd
Search URL Search Domain Scan URL
Title: Winpmem
Search URL Search Domain Scan URL
Title: Winpmem Docs
Search URL Search Domain Scan URL
Title: FTK Imager (Cmd version, mostly GUI for new versions)
Search URL Search Domain Scan URL
Title: X-Ways Imager
Search URL Search Domain Scan URL
Title: Encase Forensic
Search URL Search Domain Scan URL
Title: Tableau Imager
Search URL Search Domain Scan URL
Title: Guymager
Search URL Search Domain Scan URL
Title: Scalpel
Search URL Search Domain Scan URL
Title: Powershell
Search URL Search Domain Scan URL
Title: Special thanks Barnaby Skeggs
Search URL Search Domain Scan URL
Title: Phill Moore
Search URL Search Domain Scan URL
Title: The RULER Project - AV
Search URL Search Domain Scan URL
Title: The RULER Project - Action1
Search URL Search Domain Scan URL
Title: The RULER Project - AmmyAdmin
Search URL Search Domain Scan URL
Title: The RULER Project - AnyDesk
Search URL Search Domain Scan URL
Title: The RULER Project - Atera
Search URL Search Domain Scan URL
Title: The RULER Project - Citrix GoToMyPC
Search URL Search Domain Scan URL
Title: The RULER Project - Kaseya
Search URL Search Domain Scan URL
Title: The RULER Project - Level
Search URL Search Domain Scan URL
Title: The RULER Project - LogMeIn
Search URL Search Domain Scan URL
Title: The RULER Project - RealVNC
Search URL Search Domain Scan URL
Title: The RULER Project - Splashtop
Search URL Search Domain Scan URL
Title: The RULER Project - SupRemo
Search URL Search Domain Scan URL
Title: The RULER Project - Connectwise/Screenconnect
Search URL Search Domain Scan URL
Title: The RULER Project - TeamViewer
Search URL Search Domain Scan URL
Title: The RULER Project - TightVNC
Search URL Search Domain Scan URL
Title: The RULER Project - UltraVNC
Search URL Search Domain Scan URL
Title: The RULER Project - Ultraviewer
Search URL Search Domain Scan URL
Title: The RULER Project - Xeox
Search URL Search Domain Scan URL
Title: The RULER Project - ZohoAssist
Search URL Search Domain Scan URL
Title: Special Thanks, created from intel by The DFIR Report
Search URL Search Domain Scan URL
Title: Special Thanks
Search URL Search Domain Scan URL
Title: Special Thanks
Search URL Search Domain Scan URL
Title: Quick overview of persistent locations (AutoRuns)
Search URL Search Domain Scan URL
Title: Windows Telemetry Controller - Special Thanks to TrustedSec
Search URL Search Domain Scan URL
Title: Didier Stevens
Search URL Search Domain Scan URL
Title: multiple times
Search URL Search Domain Scan URL
Title: Original by Jeff Atwood
Search URL Search Domain Scan URL
Title: GetHooks
Search URL Search Domain Scan URL
Title: Special thanks - Josh Wright
Search URL Search Domain Scan URL
Title: Markus Piéton
Search URL Search Domain Scan URL
Title: ProxyShell
Search URL Search Domain Scan URL
Title: Special Thanks - odzhan
Search URL Search Domain Scan URL
Title: Special Thanks - Hexacorn
Search URL Search Domain Scan URL
Title: Microsoft Docs
Search URL Search Domain Scan URL
Title: MFTExplorer
Search URL Search Domain Scan URL
Title: More information on the below process
Search URL Search Domain Scan URL
Title: DLL Search Order Hijacking
Search URL Search Domain Scan URL
Title: Microsoft Docs
Search URL Search Domain Scan URL
Title: Dll Side Loading
Search URL Search Domain Scan URL
Title: Enumerate WMI Namespaces
Search URL Search Domain Scan URL
Title: Mimikatz Yara rule
Search URL Search Domain Scan URL
Title: Adam Chester
Search URL Search Domain Scan URL
Title: Grzegorz Tworek
Search URL Search Domain Scan URL
Title: DanderSpritz eventlogedit
Search URL Search Domain Scan URL
Title: Inversecos - How to Detect OAuth Access Token Theft in Azure
Search URL Search Domain Scan URL
Title: Poster
Search URL Search Domain Scan URL
Title: CrowdStrike CRT
Search URL Search Domain Scan URL
Title: PowerShell Module to show Process Tree
Search URL Search Domain Scan URL
Title: ACE Strings
Search URL Search Domain Scan URL
Title: Syntax of Security Descriptor String
Search URL Search Domain Scan URL
Title: ListDLLs
Search URL Search Domain Scan URL
Title: Matt Graeber
Search URL Search Domain Scan URL
Title: Windows Defender Application Control system integrity policy
Search URL Search Domain Scan URL
Title: Microsoft
Search URL Search Domain Scan URL
Title: Strings
Search URL Search Domain Scan URL
Title: Loki Scanner
Search URL Search Domain Scan URL
Title: Crowdresponse Scanner
Search URL Search Domain Scan URL
Title: IREC Tactical
Search URL Search Domain Scan URL
Title: Yara
Search URL Search Domain Scan URL
Title: PowerShellArsenal
Search URL Search Domain Scan URL
Title: Get-InjectedThread
Search URL Search Domain Scan URL
Title: Meterpreter Wiki
Search URL Search Domain Scan URL
Title: More Information: MS Docs
Search URL Search Domain Scan URL
Title: Event Finder2
Search URL Search Domain Scan URL
Title: Grzegorz Tworek - 0gtweet
Search URL Search Domain Scan URL
Title: User Access Logging (UAL) KStrike Parser
Search URL Search Domain Scan URL
Title: here
Search URL Search Domain Scan URL
Title: CrowdStrike Blog - Patrick Bennett
Search URL Search Domain Scan URL
Title: DeepblueCLI
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://www.jaiminton.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://www.jaiminton.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/main.js
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
www.jaiminton.com/cheatsheet/DFIR/ |
470 KB 100 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.css
www.jaiminton.com/assets/css/ |
63 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
particles.js
www.jaiminton.com/assets/js/ |
42 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
BlueTeam.jpg
www.jaiminton.com/assets/images/ |
232 KB 233 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
formbookdownloader.jpg
www.jaiminton.com/assets/images/ |
113 KB 113 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
amos-stealer.jpg
www.jaiminton.com/assets/images/ |
113 KB 114 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wasabiwallet.jpg
www.jaiminton.com/assets/images/ |
98 KB 98 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
asyncrat.jpg
www.jaiminton.com/assets/images/ |
93 KB 94 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.min.js
www.jaiminton.com/assets/js/ |
114 KB 41 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.7.1/js/ |
1 MB 390 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lunr.min.js
www.jaiminton.com/assets/js/lunr/ |
29 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lunr-store.js
www.jaiminton.com/assets/js/lunr/ |
76 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
lunr-en.js
www.jaiminton.com/assets/js/lunr/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vef91dfe02fce4ee0ad053f6de4f175db1715022073587
static.cloudflareinsights.com/beacon.min.js/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
particlesjs-config.json
www.jaiminton.com/assets/ |
2 KB 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rootdir.png
www.jaiminton.com/assets/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bio-photo.jpg
www.jaiminton.com/assets/images/ |
78 KB 78 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
www.jaiminton.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/ Frame 255B Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
rum
www.jaiminton.com/cdn-cgi/ |
0 143 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon-32x32.png
www.jaiminton.com/ |
3 KB 4 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
88b1e63c2ddc18d7
www.jaiminton.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 255B |
0 605 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| pJS function| hexToRgb function| clamp function| isInArray function| requestAnimFrame function| cancelRequestAnimFrame object| pJSDom function| particlesJS function| $ function| jQuery function| lunr object| store object| idx object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| __cfBeacon1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.jaiminton.com/ | Name: cf_clearance Value: t.lwiDKQrEd4ELm9_r8.ifqVDN17OvWQG2T2DOKizIQ-1716937631-1.0.1.1-fCNu2itx1FypRBnPpcthi05SrXngQAEMIvCMIMuwfcO9D3qnpVK6vqVpCuFfRmZ8NaByQYzs0K28WdaElDPbIQ |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
static.cloudflareinsights.com
use.fontawesome.com
www.jaiminton.com
172.67.152.236
2606:4700:3036::6815:1b98
2606:4700::6810:5049
06fbbb819a7f7c2e8b377f49130c5ae4654fbc734cacf7721ae46a6937b5aeb1
089ef3196f5de5b2bd64fde04892f6b04888b2dab0fe579bcbe61f2a31b9689e
1bedf211350e28796f14c9fca55d693bc7b3694598a92bd6435d215c2f7658ec
23267a421e3017964ca3c7884c355d050e3f052dede6035ae64325396f32475d
2475bd1214cb5a9413dbc2b29bbf10c1a718f2aeab59ea69aeac39bf7313705b
4914006e0525e89ff3d85e76aea1346550f10a86edda3435906c54a4636fd809
4d9b1921104eb209f68f191e40db355a7929c9b45205b0cb5690234f3a6277fc
5992fdee9e1280f5bff51721b618c1345ecbb2978e4776825d374ba1ac17673b
64b9f042a3cd4c1ae8364b79e3fa7a5ca42bcb13356b17542bc2c89fd562922b
70b2b469ab25b2c29a20cfdb87dcb75af7ac50764f285dea917aeabba88aedae
73ec5b416c0cf79d5535abfb80351988a2a1470ca40abc2b255fec7b9e4fc0b7
7d30097c70ad6045848450cd57b44049d296bdce594d6f5f02124334afa27a4c
809e727cb910039fef718a5bd2e1c9b2c42e9b679b686fe319bb1021c6c93006
89c8e085c3da89b31fd63bf88102068b931e58d1de9b64a2b29728ac28827d28
9bfb99372495669f6b29c9b915d9f8a7a04e36ee3e41e9363b9b8b2b55b58984
b92711806ac89c3d959cf3698e6950b41d974552dccf2c99beb4e4622f9edf55
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e71a14b59c6cd81cd4262c163d05a16dc98709f28cb51b2dd24036f4f17d1089
f54e9c4515be23c1bea9f023fd76ed45d3c98497309c4ac6e68f3777b4028ddf
f9eb189676a78d42d7a8487eef683702ada6c5c866399eefbc0df319d5f7c6d7