dirkjanm.io Open in urlscan Pro
185.199.111.153 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Effective URL:
https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Submission: On March 30 via api (March 30th 2022, 2:16:48 pm UTC) from DE — Scanned from DE

Summary HTTP 19 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 19 HTTP transactions. The main IP is 185.199.111.153, located in United States and belongs to FASTLY, US. The main domain is dirkjanm.io.
TLS certificate: Issued by R3 on February 5th 2022. Valid for: 3 months.

This is the only time dirkjanm.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
16	185.199.111.153 185.199.111.153	54113 (FASTLY) (FASTLY)
1	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
19	3

16 185.199.111.153 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-111-153.github.com

dirkjanm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::7 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	dirkjanm.io dirkjanm.io	901 KB
2	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 282	17 KB
1	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 954	326 KB
19	3

	Domain	Requested by
16	dirkjanm.io	dirkjanm.io
2	ssl.google-analytics.com	dirkjanm.io
1	use.fontawesome.com	dirkjanm.io
19	3

This site contains links to these domains. Also see Links.

Domain
outsidersecurity.nl
twitter.com
github.com
www.youtube.com
www.secura.com
www.preempt.com
www.harmj0y.net
docs.microsoft.com
www.coresecurity.com
www.facebook.com
plus.google.com
www.linkedin.com
creativecommons.org
jekyllrb.com

Subject Issuer	Validity	Valid
dirkjanm.io R3	`2022-02-05` - `2022-05-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Frame ID: A697211BFBFC756B9D26EBB6EC1CA6C1
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

A different way of abusing Zerologon (CVE-2020-1472) - dirkjanm.io

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

19
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1244 kB
Transfer

2314 kB
Size

5
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://outsidersecurity.nl/
Title: outsidersecurity.nl

Search URL Search Domain Scan URL

URL: https://twitter.com/_dirkjan
Title: Twitter

Search URL Search Domain Scan URL

URL: https://github.com/dirkjanm
Title: GitHub

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/dirkjanm
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.secura.com/blog/zero-logon
Title: Secura blog

Search URL Search Domain Scan URL

URL: https://twitter.com/_dirkjan/status/1306280553281449985
Title: read here

Search URL Search Domain Scan URL

URL: https://github.com/dirkjanm/CVE-2020-1472
Title: a restore script

Search URL Search Domain Scan URL

URL: https://www.preempt.com/blog/cve-2019-1040-windows-vulnerability/
Title: pop up

Search URL Search Domain Scan URL

URL: https://www.preempt.com/blog/active-directory-ntlm-attacks/
Title: abuse

Search URL Search Domain Scan URL

URL: https://www.harmj0y.net/blog/redteaming/not-a-security-boundary-breaking-forest-trusts/
Title: discovered

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/5e550938-91d4-459f-b67d-75d70009e3f3
Title: based on

Search URL Search Domain Scan URL

URL: https://www.coresecurity.com/core-labs/advisories/windows-pass-through-authentication-methods-improper-validation
Title: CVE-2015-0005

Search URL Search Domain Scan URL

URL: https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbrelayx.py#L242
Title: that

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/20cf9342-c1fa-49ad-a9a9-6d5f52e444fd
Title: documentation

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/3c4678e3-a528-48fe-a9ed-15b2319f7698
Title: to this page

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/95154ae4-d305-43e5-82e4-d5353e0f117c
Title: value

Search URL Search Domain Scan URL

URL: https://github.com/SecureAuthCorp/impacket/pull/857
Title: Arseniy Sharoglazov

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/e17b03b8-c1d2-43a1-98db-cf8d05b9c6a8
Title: documentation

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/c0250a97-2940-40c7-82fb-20d208c71e96
Title: NTLM documentation

Search URL Search Domain Scan URL

URL: https://github.com/x64dbg/x64dbg/issues/2411
Title: track down

Search URL Search Domain Scan URL

URL: https://github.com/leechristensen/SpoolSample
Title: POC in .NET

Search URL Search Domain Scan URL

URL: https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/tree/master/Lateral%20Movement
Title: this repo

Search URL Search Domain Scan URL

URL: https://github.com/dirkjanm/CVE-2020-1472/tree/master/relaying
Title: on my GitHub

Search URL Search Domain Scan URL

URL: https://github.com/SecureAuthCorp/impacket
Title: impacket

Search URL Search Domain Scan URL

URL: https://github.com/dirkjanm/krbrelayx
Title: krbrelayx

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=A+different+way+of+abusing+Zerologon+%28CVE-2020-1472%29%20https%3A%2F%2Fdirkjanm.io%2Fa-different-way-of-abusing-zerologon%2F
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdirkjanm.io%2Fa-different-way-of-abusing-zerologon%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https%3A%2F%2Fdirkjanm.io%2Fa-different-way-of-abusing-zerologon%2F
Title: Google+

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fdirkjanm.io%2Fa-different-way-of-abusing-zerologon%2F
Title: LinkedIn

Search URL Search Domain Scan URL

URL: http://creativecommons.org/licenses/by/4.0/

Search URL Search Domain Scan URL

URL: https://jekyllrb.com/
Title: Jekyll

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
dirkjanm.io/a-different-way-of-abusing-zerologon/ 38 KB
12 KB 131ms
103ms Document
text/html 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 3a9fa98c4864d90d5f85e8d985a43d7b03ceeb47034e1247d6378b6fc810e9e0

Request headers

Accept-Language: de-DE,de;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 0
cache-control: max-age=600
content-encoding: gzip
content-length: 12264
content-type: text/html; charset=utf-8
date: Wed, 30 Mar 2022 14:16:43 GMT
etag: W/"6215628a-99ef"
expires: Wed, 30 Mar 2022 14:26:43 GMT
last-modified: Tue, 22 Feb 2022 22:24:10 GMT
server: GitHub.com
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: d85f70aa53d3c8b7cabdca01bb7ac1d32cebd6a3
x-github-request-id: 9E74:E054:1EEBF7:1F8D46:6244664B
x-proxy-cache: MISS
x-served-by: cache-hhn4036-HHN
x-timer: S1648649803.490790,VS0,VE97

GET
H2 200 main.css
dirkjanm.io/assets/css/ 61 KB
12 KB 129ms
129ms Stylesheet
text/css 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://dirkjanm.io/assets/css/main.css
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: a3facf9aaad61efabecb1c539adcab7895c21ba802a3bd4396b30b64456c731e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 29993fb36794097a1241c1419df8ee2d9e125498
date: Wed, 30 Mar 2022 14:16:43 GMT
content-encoding: gzip
age: 0
x-cache: MISS
content-length: 12350
x-served-by: cache-hhn4036-HHN
access-control-allow-origin: *
last-modified: Tue, 22 Feb 2022 22:24:10 GMT
server: GitHub.com
x-github-request-id: 99A6:3C66:F913B:1007C3:624461DC
x-timer: S1648649804.676110,VS0,VE103
etag: W/"6215628a-f594"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Wed, 30 Mar 2022 14:07:48 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 thisisapicture.png
dirkjanm.io/assets/img/ 13 KB
13 KB 109ms
109ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/thisisapicture.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: e6d3de5c0c396e11d8c0f1d2d13d01597c8306d9f4dc86b3cfd486446dcc293d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: a47d083a5bd68682c66942c7a0dd6abb8177e360
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: HIT
content-length: 12903
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 3D48:CD5A:230A5EC:23FFEEF:6243ABBC
x-timer: S1648649804.676218,VS0,VE98
etag: "62156284-3267"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 01:10:44 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 1

GET
H2 200 netlogon.svg
dirkjanm.io/assets/img/zerologon/ 234 KB
88 KB 147ms
145ms Image
image/svg+xml 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/netlogon.svg
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: c807a466b44cfc23397de8ed1ae66bda4ec5bddcf8571e8bdbe06ecb7a1138ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 2a7fa21cd77f56db065d7296b48e361c7daa6083
date: Wed, 30 Mar 2022 14:16:43 GMT
content-encoding: gzip
age: 0
x-cache: MISS
content-length: 90209
x-served-by: cache-hhn4036-HHN
access-control-allow-origin: *
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: B4BC:5FD9:12021F:12835F:6244664B
x-timer: S1648649804.676374,VS0,VE112
etag: W/"62156284-3a7ea"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 smbrelay_signing.png
dirkjanm.io/assets/img/zerologon/ 85 KB
85 KB 127ms
126ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/smbrelay_signing.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: dfd3853bc0803de9d69178a58aa4da324b293a381ffff597034e932deb4be713

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 15cc60ad5d34ed02db7519a0a1eb2358a8194b69
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
fastly-original-body-size: 87007
age: 0
x-cache: MISS
content-length: 87007
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 4F6A:5FD9:12021F:12835E:6244664B
x-timer: S1648649804.676478,VS0,VE102
etag: "62156284-153df"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 nosealing_error.png
dirkjanm.io/assets/img/zerologon/ 74 KB
74 KB 125ms
123ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/nosealing_error.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 6d6f1faa69f3c0bf66eff033a852831989da722a7694ca82443ae4d301cf01d6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 9bbfd3eeeac83dbe2b41aaeffe3b8e89edf9a141
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
fastly-original-body-size: 75694
age: 0
x-cache: MISS
content-length: 75694
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 2EEA:9626:F9BB8:101803:6244664B
x-timer: S1648649804.676539,VS0,VE100
etag: "62156284-127ae"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 nosealing.png
dirkjanm.io/assets/img/zerologon/ 36 KB
37 KB 113ms
112ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/nosealing.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 16571f5ae91c9a79eaa27779139560f26521d3686c625fb42b2b982c1872563d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: c74908d3cdae66b679484e9de4497c514186f468
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
x-cache-hits: 0
content-length: 37086
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: B984:D3BD:21D56F:227BC5:6244664B
x-timer: S1648649804.676617,VS0,VE98
etag: "62156284-90de"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
expires: Wed, 30 Mar 2022 14:26:43 GMT

GET
H2 200 dcsync_da.png
dirkjanm.io/assets/img/zerologon/ 76 KB
76 KB 140ms
139ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/dcsync_da.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: d172e4bbb924574427a13fe95f480942626845e88936f264a0335adcbf75d91f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 0cc71aa80bb80da705dc288cc3097cd177167135
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
x-cache-hits: 0
content-length: 77994
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: E358:E053:10FCD4:117C62:6244664B
x-timer: S1648649804.676729,VS0,VE105
etag: "62156284-130aa"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
expires: Wed, 30 Mar 2022 14:26:43 GMT

GET
H2 200 netlogon_wireshark.png
dirkjanm.io/assets/img/zerologon/ 53 KB
54 KB 124ms
122ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/netlogon_wireshark.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 9b9f71b67661f7a81d65283cdda6f5b024349ffec1909a926102e806fbf90a3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: a7703f68c679b7df9f6b28593be58ffa24466731
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
fastly-original-body-size: 54741
age: 0
x-cache: MISS
content-length: 54741
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 2D50:12046:208EE0:213439:6244664B
x-timer: S1648649804.676792,VS0,VE98
etag: "62156284-d5d5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 lsass_struct.png
dirkjanm.io/assets/img/zerologon/ 54 KB
54 KB 126ms
125ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/lsass_struct.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 8a2423be64682801ac11d1575370a8a2c8c567bb55a42ded59985b68faa49f66

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 880c3ba443dc3e54928519e90a32dc95d8bf8c5b
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
fastly-original-body-size: 55235
age: 0
x-cache: MISS
content-length: 55235
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: BA28:D3BD:21D56F:227BC4:6244664B
x-timer: S1648649804.676846,VS0,VE102
etag: "62156284-d7c3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 zerologon_sploit.svg
dirkjanm.io/assets/img/zerologon/ 252 KB
93 KB 146ms
145ms Image
image/svg+xml 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/zerologon_sploit.svg
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 6ce7a93ee3e73ba6a213bf74b63383f149922b2d759f7c49703be21f4dad23fd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: f8796e504da1abd1e5ee27ab771781789a5ba464
date: Wed, 30 Mar 2022 14:16:43 GMT
content-encoding: gzip
age: 0
x-cache: MISS
content-length: 95172
x-served-by: cache-hhn4036-HHN
access-control-allow-origin: *
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: CE82:5F82:106504:10E3AB:6244664B
x-timer: S1648649804.681887,VS0,VE105
etag: W/"62156284-3eee4"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 relaying.png
dirkjanm.io/assets/img/zerologon/ 89 KB
89 KB 125ms
124ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/relaying.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: f8bb96c06893b580c2ca1a1a7a25c9fc44e9166e614412e52f1d81f43627ee98

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: 985569bc4baa18eb462036c5b23505e946543c8d
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
content-length: 90829
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 5672:10468:206E59:2114C4:6244664B
x-timer: S1648649804.681981,VS0,VE95
etag: "62156284-162cd"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 relayresult.png
dirkjanm.io/assets/img/zerologon/ 84 KB
84 KB 124ms
124ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/relayresult.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: f1cce1eff7365466055f220e7fcd36cec50b40a4d92f58d0f741df5878ab2f28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: a77be95a9ee4e70c08d5d44b0f5fb81800bd96ef
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
content-length: 86035
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 359A:D3BD:21D56F:227BC6:6244664B
x-timer: S1648649804.682033,VS0,VE95
etag: "62156284-15013"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 relayresult_smb.png
dirkjanm.io/assets/img/zerologon/ 87 KB
87 KB 125ms
125ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/zerologon/relayresult_smb.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: c29695e9eca6a22d7c5688610c089a19bdeeeb50f2be1409580e818063aefc88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: edb1701cc8282e738a2450a3e61f95920e4fe1a4
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
fastly-original-body-size: 89271
age: 0
x-cache: MISS
content-length: 89271
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: AC72:5FD9:12021F:128360:6244664B
x-timer: S1648649804.682115,VS0,VE96
etag: "62156284-15cb7"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
expires: Wed, 30 Mar 2022 14:26:43 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 cc-by.png
dirkjanm.io/assets/img/ 1 KB
2 KB 125ms
124ms Image
image/png 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dirkjanm.io/assets/img/cc-by.png
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 84294b65bbfc0cd6021e609bbb7d36c432d242a66bd024d959ced0218db6ec3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: a2c2680a78fff14f2eb4701f2cc61cb2fda02281
date: Wed, 30 Mar 2022 14:16:43 GMT
via: 1.1 varnish
age: 0
x-cache: HIT
x-cache-hits: 1
content-length: 1468
x-served-by: cache-hhn4036-HHN
last-modified: Tue, 22 Feb 2022 22:24:04 GMT
server: GitHub.com
x-github-request-id: 3954:1399:105D6A:14BB1B:6243ABBD
x-timer: S1648649804.682204,VS0,VE95
etag: "62156284-5bc"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
expires: Wed, 30 Mar 2022 01:10:45 GMT

GET
H2 200 main.min.js Show response
dirkjanm.io/assets/js/ 113 KB
40 KB 108ms
107ms Script
application/javascript 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://dirkjanm.io/assets/js/main.min.js
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-111-153.github.com
Software: GitHub.com /
Resource Hash: 796a7a154a3ca28c51c7c3d6a9b46b13e03f77ce1460f6379a93e318d3464291

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-fastly-request-id: a26999447a99405dd5d0b751f40d96360b9fe46d
date: Wed, 30 Mar 2022 14:16:43 GMT
content-encoding: gzip
fastly-original-body-size: 0
age: 0
x-cache: MISS
content-length: 40346
x-served-by: cache-hhn4036-HHN
access-control-allow-origin: *
last-modified: Tue, 22 Feb 2022 22:24:07 GMT
server: GitHub.com
x-github-request-id: 206C:5F82:F397C:FAFBE:624461DD
x-timer: S1648649804.676304,VS0,VE98
etag: W/"62156287-1c225"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
expires: Wed, 30 Mar 2022 14:07:49 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 0

GET
H2 200 all.js Show response
use.fontawesome.com/releases/v5.2.0/js/ 918 KB
326 KB 80ms
44ms Script
application/javascript 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.2.0/js/all.js
Requested by: Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 97588c43a7f4fbc68507348d47182494b95832abb94b86ff2e96924f6b3e8288

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 14:16:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1990084
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 5Q57A55715KHMSTR
x-amz-id-2: 8yBoW7cP+jNYrR5a1MFu0q6WvV3N9iV+5hu7EG7iqwUc/anOq9kf4MlNELhugFK/Io3QB35SSHg=
last-modified: Wed, 30 Jun 2021 15:41:36 GMT
server: cloudflare
etag: W/"0e381f06febb9521bd07d5f5d7d2bdf9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fos1v77QK%2FZGWIkoc%2BGSYh0m43Xp7LW9n05YnWySHK1HC7Rn4hUg%2FY7S4kcPQIJ5ynh%2BCmSKUAekh30R8KyiTSni4P6Xo96p8ti13K147oC4EvLps8ZJ%2BEiKJNu1eWxWMctEEdnUxzumpBFKIYxrzPpn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31556926
cf-ray: 6f4176f92b5c9b80-FRA

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 126ms
37ms Script
text/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4126
date: Wed, 30 Mar 2022 13:07:58 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Wed, 30 Mar 2022 15:07:58 GMT

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 45ms
45ms Image
image/gif 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=315356565&utmhn=dirkjanm.io&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=A%20different%20way%20of%20abusing%20Zerologon%20(CVE-2020-1472)%20-%20dirkjanm.io&utmhid=679886055&utmr=-&utmp=%2Fa-different-way-of-abusing-zerologon%2F&utmht=1648649804103&utmac=UA-125398868-1&utmcc=__utma%3D75103879.763894794.1648649804.1648649804.1648649804.1%3B%2B__utmz%3D75103879.1648649804.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1881939188&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: dirkjanm.io
URL: https://dirkjanm.io/a-different-way-of-abusing-zerologon/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dirkjanm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Mar 2022 14:16:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dirkjanm.io/	1970-01-20 19:28:41	Name: __utma Value: 75103879.763894794.1648649804.1648649804.1648649804.1
.dirkjanm.io/	1969-12-31 23:59:59	Name: __utmc Value: 75103879
.dirkjanm.io/	1970-01-20 06:20:17	Name: __utmz Value: 75103879.1648649804.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.dirkjanm.io/	1970-01-20 01:57:30	Name: __utmt Value: 1
.dirkjanm.io/	1970-01-20 01:57:31	Name: __utmb Value: 75103879.1.10.1648649804

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dirkjanm.io
ssl.google-analytics.com
use.fontawesome.com
185.199.111.153
2a00:1450:4001:82f::2008
2a06:98c1:3120::7
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
16571f5ae91c9a79eaa27779139560f26521d3686c625fb42b2b982c1872563d
3a9fa98c4864d90d5f85e8d985a43d7b03ceeb47034e1247d6378b6fc810e9e0
6ce7a93ee3e73ba6a213bf74b63383f149922b2d759f7c49703be21f4dad23fd
6d6f1faa69f3c0bf66eff033a852831989da722a7694ca82443ae4d301cf01d6
796a7a154a3ca28c51c7c3d6a9b46b13e03f77ce1460f6379a93e318d3464291
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84294b65bbfc0cd6021e609bbb7d36c432d242a66bd024d959ced0218db6ec3f
8a2423be64682801ac11d1575370a8a2c8c567bb55a42ded59985b68faa49f66
97588c43a7f4fbc68507348d47182494b95832abb94b86ff2e96924f6b3e8288
9b9f71b67661f7a81d65283cdda6f5b024349ffec1909a926102e806fbf90a3f
a3facf9aaad61efabecb1c539adcab7895c21ba802a3bd4396b30b64456c731e
c29695e9eca6a22d7c5688610c089a19bdeeeb50f2be1409580e818063aefc88
c807a466b44cfc23397de8ed1ae66bda4ec5bddcf8571e8bdbe06ecb7a1138ae
d172e4bbb924574427a13fe95f480942626845e88936f264a0335adcbf75d91f
dfd3853bc0803de9d69178a58aa4da324b293a381ffff597034e932deb4be713
e6d3de5c0c396e11d8c0f1d2d13d01597c8306d9f4dc86b3cfd486446dcc293d
f1cce1eff7365466055f220e7fcd36cec50b40a4d92f58d0f741df5878ab2f28
f8bb96c06893b580c2ca1a1a7a25c9fc44e9166e614412e52f1d81f43627ee98

dirkjanm.io Open in urlscan Pro 185.199.111.153 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1244 kBTransfer

2314 kBSize

5 Cookies

31 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

5 Cookies

Indicators

dirkjanm.io Open in urlscan Pro
185.199.111.153 Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1244 kB
Transfer

2314 kB
Size

5
Cookies

19 HTTP transactions
0 data transactions