pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Submission: On December 28 via manual (December 28th 2020, 6:56:15 pm UTC) from US

Summary HTTP 97 Redirects Links 39 Behaviour Indicators

Summary

This website contacted 20 IPs in 4 countries across 13 domains to perform 97 HTTP transactions. The main IP is 192.0.78.25, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlab.blog.
TLS certificate: Issued by R3 on December 18th 2020. Valid for: 3 months.

This is the only time pentestlab.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
26	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE)
5	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
30	192.0.72.29 192.0.72.29	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2a00:1450:400... 2a00:1450:4001:814::2004	15169 (GOOGLE) (GOOGLE)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
4	192.0.123.248 192.0.123.248	2635 (AUTOMATTIC) (AUTOMATTIC)
6	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.75.88.209 104.75.88.209	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	192.0.78.18 192.0.78.18	2635 (AUTOMATTIC) (AUTOMATTIC)
1	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
97	20

2 192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.blog	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 192.0.72.29 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

pentestlab.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.75.88.209 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-209.deploy.static.akamaitechnologies.com

api.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.18 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.8 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	wp.com s0.wp.com stats.wp.com widgets.wp.com pixel.wp.com	479 KB
31	wordpress.com pentestlab.files.wordpress.com r-login.wordpress.com	6 MB
6	gstatic.com fonts.gstatic.com www.gstatic.com	200 KB
5	twitter.com platform.twitter.com syndication.twitter.com	32 KB
5	gravatar.com 1.gravatar.com 0.gravatar.com	13 KB
4	polldaddy.com polldaddy.com	9 KB
3	facebook.com www.facebook.com graph.facebook.com	629 B
3	google.com www.google.com	646 B
2	facebook.net connect.facebook.net	61 KB
2	googleapis.com fonts.googleapis.com	2 KB
2	pentestlab.blog pentestlab.blog	53 KB
1	pinterest.com api.pinterest.com	366 B
1	youtube.com www.youtube.com
97	13

	Domain	Requested by
30	pentestlab.files.wordpress.com	pentestlab.blog
24	s0.wp.com	pentestlab.blog s0.wp.com
5	pixel.wp.com	pentestlab.blog
5	fonts.gstatic.com	fonts.googleapis.com
4	polldaddy.com	pentestlab.blog polldaddy.com
4	platform.twitter.com	pentestlab.blog platform.twitter.com
3	www.google.com	pentestlab.blog www.gstatic.com
3	0.gravatar.com	pentestlab.blog 0.gravatar.com
2	widgets.wp.com	pentestlab.blog s0.wp.com
2	www.facebook.com	connect.facebook.net
2	connect.facebook.net	s0.wp.com connect.facebook.net
2	1.gravatar.com	pentestlab.blog
2	fonts.googleapis.com	pentestlab.blog s0.wp.com
2	pentestlab.blog	s0.wp.com
1	syndication.twitter.com
1	r-login.wordpress.com	pentestlab.blog
1	graph.facebook.com	s0.wp.com
1	api.pinterest.com	s0.wp.com
1	www.gstatic.com	www.google.com
1	www.youtube.com	pentestlab.blog
1	stats.wp.com	pentestlab.blog
97	21

This site contains links to these domains. Also see Links.

Domain
github.com
twitter.com
10.0.0.13
malicious.link
attack.mitre.org
enigma0x3.net
gravatar.com
discord.gg
www.facebook.com
wordpress.com
pentestlab.wordpress.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2020-12-18` - `2021-03-18`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-12-21` - `2022-01-21`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.polldaddy.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-11-02` - `2021-01-30`	3 months	crt.sh
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 11 frames:

Primary Page: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Frame ID: 3EBB6D2223788BE5731567D4ED588E0E
Requests: 88 HTTP requests in this frame

Frame: https://www.youtube.com/embed/MqLTUZBEliE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
Frame ID: 24E9A175F0F6E2CE016C09996F2CD30F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df231dd82ecbe1fc%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
Frame ID: 956D62489665B9366D395BE99BF7F4A1
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20200826
Frame ID: EB5E21626C45F788025494110C214209
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fpentestlab.blog
Frame ID: 815AB390D71F396ED6F02F56B2CE8D21
Requests: 1 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1609181757
Frame ID: FB94EF02480CF90F04F7598846183E1B
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=qc5B-qjP0QEimFYUxcpWJy5B&theme=light&size=normal&cb=l5agw9721fsk
Frame ID: 3D989ADB54692ACA4564542FADCE165B
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/index.html?ver=20200826
Frame ID: E6FDDC8FC207FDE11AB5FAD53E9A4B51
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2d42aa437df%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=0&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
Frame ID: C234A47E58816AE0984655A185DD348D
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Frame ID: A84F7E353C0A80B5AADF7D3463C95B4A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=xiiq4k13auli
Frame ID: A978DFD9A8BBC52C3136683AB002A8AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

97
Requests

100 %
HTTPS

58 %
IPv6

13
Domains

21
Subdomains

20
IPs

4
Countries

7237 kB
Transfer

8439 kB
Size

2
Cookies

39 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/bitsadmin/fakelogonscreen
Title: FakeLogonScreen

Search URL Search Domain Scan URL

URL: https://twitter.com/bitsadmin
Title: Arris Huijgen

Search URL Search Domain Scan URL

URL: https://github.com/Pickfordmatt/SharpLocker
Title: SharpLocker

Search URL Search Domain Scan URL

URL: https://twitter.com/Mattspickford
Title: Matt Pickford

Search URL Search Domain Scan URL

URL: https://github.com/Dviros/CredsLeaker
Title: CredsLeaker

Search URL Search Domain Scan URL

URL: https://twitter.com/enigma0x3
Title: Matt Nelson

Search URL Search Domain Scan URL

URL: https://github.com/enigma0x3/Invoke-LoginPrompt
Title: script

Search URL Search Domain Scan URL

URL: http://10.0.0.13/tmp/Invoke-LoginPrompt.ps1
Title: http://10.0.0.13/tmp/Invoke-LoginPrompt.ps1

Search URL Search Domain Scan URL

URL: https://github.com/samratashok/nishang/blob/master/Gather/Invoke-CredentialsPhish.ps1
Title: script

Search URL Search Domain Scan URL

URL: http://10.0.0.13/tmp/Invoke-CredentialsPhish/ps1
Title: http://10.0.0.13/tmp/Invoke-CredentialsPhish/ps1

Search URL Search Domain Scan URL

URL: https://twitter.com/mubix
Title: Rob Fuller

Search URL Search Domain Scan URL

URL: https://malicious.link/post/2015/powershell-popups-and-capture/
Title: blog

Search URL Search Domain Scan URL

URL: http://10.0.0.13/
Title: http://10.0.0.13/

Search URL Search Domain Scan URL

URL: https://github.com/thelinuxchoice/lockphish
Title: Lockphish

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1141/
Title: https://attack.mitre.org/techniques/T1141/

Search URL Search Domain Scan URL

URL: https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
Title: https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/

Search URL Search Domain Scan URL

URL: https://gravatar.com/site/signup/
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX
Title: @ Twitter

Search URL Search Domain Scan URL

URL: http://twitter.com/pwnDefend
Title: pwnDefend

Search URL Search Domain Scan URL

URL: https://twitter.com/i/web/status/1343607925420515328
Title: twitter.com/i/web/status/1…

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1343607925420515328
Title: 1 hour ago

Search URL Search Domain Scan URL

URL: http://twitter.com/MDSecLabs
Title: MDSecLabs

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1343580997582008321
Title: 3 hours ago

Search URL Search Domain Scan URL

URL: http://twitter.com/OutflankNL
Title: OutflankNL

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1343555598533750785
Title: 5 hours ago

Search URL Search Domain Scan URL

URL: http://twitter.com/RedTeamEric1
Title: RedTeamEric1

Search URL Search Domain Scan URL

URL: http://twitter.com/EncodeCyber
Title: EncodeCyber

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1343536929405624321
Title: 6 hours ago

Search URL Search Domain Scan URL

URL: https://twitter.com/i/web/status/1343534316761059330
Title: twitter.com/i/web/status/1…

Search URL Search Domain Scan URL

URL: http://twitter.com/netbiosX/statuses/1343534316761059330
Title: 6 hours ago

Search URL Search Domain Scan URL

URL: https://discord.gg/rR6FJBH
Title: Discord

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pentestlaboratory/
Title: Facebook Page

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_blog
Title: Blog at WordPress.com.

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F&signup_flow=account&domain=pentestlab.blog
Title: Log in now.

Search URL Search Domain Scan URL

URL: https://pentestlab.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fpentestlab.wordpress.com%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wp.me/p2cWvm-7cH
Title: Copy shortlink

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

97 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pentestlab.blog/2020/03/02/phishing-windows-credentials/ 202 KB
52 KB 798ms
780ms Document
text/html 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9ab3c9f66c0999e264a5756cb47752a136162aa7cfb8ddadf88dbc9a9a172c0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: pentestlab.blog
:scheme: https
:path: /2020/03/02/phishing-windows-credentials/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: nginx
date: Mon, 28 Dec 2020 18:55:58 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback: https://pentestlab.blog/xmlrpc.php
link: <https://wp.me/p2cWvm-7cH>; rel=shortlink
last-modified: Mon, 28 Dec 2020 18:55:57 GMT
cache-control: max-age=300, must-revalidate
x-nananana: Batcache
content-encoding: gzip
x-ac: 2.hhn _dfw

GET
H2 200 /
s0.wp.com/_static/ 241 KB
33 KB 29ms
11ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJylktlqAzEMRX+oGjVpMrQPpd/iRbhOvGHJhPn7Ou5CmIY00BfDle8RurLxVMDkJJQEY4MSmvOJ8VRMjsDRB1pWajLMD3gdqxSUkIWSWVbqFhb8kRgPJEWZIwz1y/7tda1LTdX1m0r4Mu2nLermg0Ud8sB1VXVBliXQ/9vIO8V72gzqIoRachNw1du7J1m1qEp8cvwHbvIXtu0RntB6lp8aXEcvNn8O3+uxKDk7IlmvKPTESW5hnx9C61KJGfoZfYswVjVe7i2+bubH580873b7wwc67uTS?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3192730e0123148fb8c0c2351fd47683b4c3927a4e59be58eb923813496c49db

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Thu, 17 Dec 2020 00:54:52 GMT
server: nginx
etag: W/"5fdaac5c-3c428"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Tue, 21 Dec 2021 12:39:20 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
986 B 36ms
15ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=5.6-RC5-49737

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cc11081dbad9f1e7a88a835a060df43518342f9e727b5abd91d0d422137d1dfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 28 Dec 2020 18:55:58 GMT
server: ESF
date: Mon, 28 Dec 2020 18:55:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 28 Dec 2020 18:55:58 GMT

GET
H2 200 /
s0.wp.com/_static/ 64 KB
14 KB 33ms
15ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNkEEOwjAMBD+ECUUUqQfEW0Jwg6kTV3Giwu9JuaAKqXDbsXb2YDON4CRmjNnkGwZUMyYMVMKMvZRknKrpawXshCoBt/WwMb89zU/+LocCIxdPUc1EV4+5jluHF5EBmIYaHv+bKo4sA9XKEtZkjwIszmaSuADo2VJaUxNeWHyN/v2VD87SOZyatmu7/bHZHe4vDS2BuQ==?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 61c52736ce8a30fc80ee898ba252d0c8f3587f7abea693d7fbae60675651cdcb

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Tue, 11 Aug 2020 17:22:33 GMT
server: nginx
etag: W/"5f32d3d9-fe1a"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 10:10:47 GMT

GET
H2 200 /
s0.wp.com/_static/ 29 KB
11 KB 33ms
15ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxti8sKgCAQAH8oW6KHdoi+xcTUWF1pjX4/OnSIOg0DM3BmYSgVmwrEQ2Q8XEgMmbiIFXXYgb3eQ3IPa8Ncwf/FZIJGgeToLZ+peBstg+/AIS0a72COU9OPUg69atV2AWWKN+I=?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 03d1076123112f8b3de7daaabeb7e4df9147a4d20feca5597c40dd62eca16791

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 15:51:22 GMT
server: nginx
etag: W/"5f3bf8fa-72b0"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:09 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 119 KB
39 KB 35ms
17ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/mobile-useragent-info.js,/wp-includes/js/jquery/jquery.js,/wp-content/mu-plugins/related-posts/related-posts.js?m=1608135399j
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c6453de2cc28ace38af345b6caba817ace52d1d102e213c3a1950b351ad8a035

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Wed, 16 Dec 2020 16:16:47 GMT
server: nginx
etag: W/"5fda32ef-1dad8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Thu, 16 Dec 2021 16:16:53 GMT

GET
H2 200 style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 19 KB
3 KB 34ms
16ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5b33f7b7-5e1f"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:05 GMT

GET
H2 200 /
s0.wp.com/ 5 KB
1 KB 33ms
16ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/?custom-css=1&csblog=2cWvm&cscache=6&csrev=34
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 893a7a315254505f93d4c92ada4651a29eab01b5f46047c15ebf8dedca408414

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
x-nc: HIT hhn 2
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 10:10:47 GMT

GET
H2 200 4605db59f0637ffc3e084bd14d744ff7
1.gravatar.com/avatar/ 1 KB
1 KB 15ms
5ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=32&d=identicon&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 72f6111c826a30ccd1f165810abe57ede94f3e780e3cfb3e706cd08ccde1c14e

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 28 Dec 2020 18:55:58 GMT
last-modified: Sun, 19 Feb 2012 06:41:30 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="4605db59f0637ffc3e084bd14d744ff7.jpeg"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/4605db59f0637ffc3e084bd14d744ff7?s=32&d=identicon&r=G>; rel="canonical"
content-length: 1163
expires: Mon, 28 Dec 2020 19:00:58 GMT

GET
H2 200 input-prompt-fakelogonscreen.png
pentestlab.files.wordpress.com/2020/02/ 119 KB
120 KB 50ms
16ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8d13ae92ee8e79364a4e3a5eb49b6eecee7b5886faece5c207ca03461af6c36b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:22:46 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 122343
expires: Mon, 11 Jan 2021 19:47:40 GMT

GET
H2 200 input-prompt-fakelogonscreen-windows.png
pentestlab.files.wordpress.com/2020/02/ 828 KB
829 KB 49ms
15ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-windows.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cba32f71b1e21bb69ee0e7a94b68b7c63c95957fbd1a561c19eb9fe0f5e9c2da

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:25:20 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 847939
access-control-allow-credentials: true
expires: Mon, 01 Feb 2021 02:46:21 GMT

GET
H2 200 input-prompt-fakelogonscreen-credentials.png
pentestlab.files.wordpress.com/2020/02/ 73 KB
73 KB 50ms
16ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2b9e020056bd63eec5d5905d220780d2036ec776595cdf83eef9de3cb191366f

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:27:20 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 74910
expires: Mon, 04 Jan 2021 23:41:32 GMT

GET
H2 200 input-prompt-fakelogonscreen-credentials-stored.png
pentestlab.files.wordpress.com/2020/02/ 139 KB
139 KB 50ms
16ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-credentials-stored.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3b5803d4f600ba6f07f7d802daeae542dbde291aa3b1d170954ef7f5ac569563

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:28:56 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 141919
expires: Thu, 14 Jan 2021 18:32:36 GMT

GET
H2 200 input-prompt-sharplocker-lock-screen.png
pentestlab.files.wordpress.com/2020/02/ 790 KB
791 KB 54ms
21ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-sharplocker-lock-screen.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e8e37a38074c0878aa6615f997afd39b90e269251dde584c70ee790778cd9af1

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 10:48:23 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 808613
access-control-allow-credentials: true
expires: Fri, 15 Jan 2021 22:43:32 GMT

GET
H2 200 input-prompt-sharplocker.png
pentestlab.files.wordpress.com/2020/02/ 165 KB
165 KB 54ms
21ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-sharplocker.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7cc264e349679f450869ba46c806ba0dbf5a525bf9eb388433ecf05bd8d06093

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 10:49:51 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 168836
expires: Tue, 12 Jan 2021 10:05:30 GMT

GET
H2 200 input-prompt-credsleaker-http.png
pentestlab.files.wordpress.com/2020/03/ 133 KB
134 KB 79ms
75ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/03/input-prompt-credsleaker-http.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

4e3c26b195de4359f1bf3711f15b4858015b006556c8e2af5c6df627a0959f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sun, 01 Mar 2020 09:56:48 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 136592
expires: Thu, 14 Jan 2021 06:09:44 GMT

GET
H2 200 input-prompt-credsleaker-screen.png
pentestlab.files.wordpress.com/2020/02/ 121 KB
121 KB 79ms
75ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-credsleaker-screen.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a17e2f9f05d01c0bbbe018eaa6bb91113a5b253e3f0de4719969dc936f9d5e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 12:53:55 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 123849
expires: Thu, 31 Dec 2020 15:09:21 GMT

GET
H2 200 input-prompt-credsleaker-credentials.png
pentestlab.files.wordpress.com/2020/02/ 63 KB
63 KB 80ms
75ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-credsleaker-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8269e79540b61f9c52daeccf593070340da1bc8a67330476f4870f4ec7722503

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 12:55:06 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 64748
expires: Tue, 05 Jan 2021 09:54:42 GMT

GET
H2 200 input-prompt-powershell.png
pentestlab.files.wordpress.com/2020/02/ 105 KB
106 KB 80ms
76ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

6d42849613c979cbd20fa9b2bc66f99ad8dad334299252851fce918531e599fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 10:46:05 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 107896
expires: Tue, 12 Jan 2021 14:15:24 GMT

GET
H2 200 input-prompt-powershell-invoke-credentialsphish.png
pentestlab.files.wordpress.com/2020/02/ 27 KB
27 KB 80ms
76ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-invoke-credentialsphish.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

00db98b9eee1771f3cc2d7124438f103cfdf17fb4b46b3d3fa0962615d27e908

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:10:47 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 27734
expires: Mon, 11 Jan 2021 14:19:27 GMT

GET
H2 200 input-prompt-invoke-credentialsphish.png
pentestlab.files.wordpress.com/2020/02/ 167 KB
168 KB 82ms
78ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-invoke-credentialsphish.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b5c11890fda6432b21e85c6d39487c18e36d278facc0f19dcb257e736d5bb7c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:16:39 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 171500
access-control-allow-credentials: true
expires: Wed, 06 Jan 2021 19:21:13 GMT

GET
H2 200 input-prompt-invokecredentialsphish-credentials.png
pentestlab.files.wordpress.com/2020/02/ 14 KB
14 KB 80ms
77ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-invokecredentialsphish-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

393a213ef00f9d5ec1c6a3f26f4ee9f809ff5b9d74a58c8a6419a9ac96515bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:13:53 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 14386
expires: Fri, 22 Jan 2021 00:40:46 GMT

GET
H2 200 webfont.js Show response
s0.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 17ms
11ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"573b08bd-30cd"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:08 GMT

GET
H2 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 14 KB
5 KB 17ms
12ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1605528427h&ver=5.6-RC5-49737
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3685c3818240f5f390073c7d04f944a5cb5d848093224f3a7888034e8c050eb4

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5fb26b73-37a6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Thu, 09 Dec 2021 12:22:14 GMT

GET
H2 200 input-prompt-invoke-credentialsphish-shell.png
pentestlab.files.wordpress.com/2020/02/ 87 KB
87 KB 80ms
77ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-invoke-credentialsphish-shell.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

9717a8ee8bbe0c7d99fbba9bf7a74fc24ba7e9361221f54ca333ee30e54f4474

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 21:12:03 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 89106
expires: Mon, 01 Feb 2021 21:00:52 GMT

GET
H2 200 input-prompt-powershell-base64.png
pentestlab.files.wordpress.com/2020/02/ 517 KB
518 KB 80ms
77ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-base64.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

08ac71341cf5d9e4804399f091ce495533990f6088fdf4064a3c91b1294ca4dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 12:29:38 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 529906
expires: Wed, 13 Jan 2021 20:10:27 GMT

GET
H2 200 input-prompt-powershell-base64-login.png
pentestlab.files.wordpress.com/2020/02/ 135 KB
135 KB 81ms
77ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-base64-login.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

877a42370ac831903fd5ed13b7882111d4f69e67e7db541c18893cfa9da3e7d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 12:34:53 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 137923
access-control-allow-credentials: true
expires: Fri, 01 Jan 2021 06:30:35 GMT

GET
H2 200 input-prompt-metasploit-capture-authentication.png
pentestlab.files.wordpress.com/2020/02/ 275 KB
275 KB 81ms
77ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-capture-authentication.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bb0ad39a956ea689a5f992ce22ee39329ef342c9e18c9679904c56d7aebaf96c

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 12:33:01 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 281381
expires: Thu, 14 Jan 2021 01:44:59 GMT

GET
H2 200 input-prompt-metasploit-module.png
pentestlab.files.wordpress.com/2020/02/ 155 KB
155 KB 81ms
78ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3922421878d5b0f7af38a59193191202c018da5e10fdcae3ef58f2abf360c6b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 21:56:56 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 158614
expires: Wed, 27 Jan 2021 09:49:39 GMT

GET
H2 200 input-prompt-metasploit-module-all-processes.png
pentestlab.files.wordpress.com/2020/02/ 282 KB
282 KB 81ms
78ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-all-processes.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

bec55f93f48d9f10c9899d4755533c197768f85046999c01a14ce8fc059e7393

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:14:19 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 288291
expires: Fri, 29 Jan 2021 20:18:27 GMT

GET
H2 200 input-prompt-windows-authentication-window-metasploit.png
pentestlab.files.wordpress.com/2020/02/ 79 KB
79 KB 83ms
80ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-windows-authentication-window-metasploit.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

25510b668f142f8d9acf744481b110f3d2790835c0f336433aaff694610e03ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:04:57 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 80472
access-control-allow-credentials: true
expires: Tue, 05 Jan 2021 20:45:29 GMT

GET
H2 200 input-prompt-metasploit-module-all-processes-credentials.png
pentestlab.files.wordpress.com/2020/02/ 270 KB
270 KB 83ms
80ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-all-processes-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e6d170af18ce67bba11e319fb3abd1356b3d9bdfc299c6df50b9fe789912ba7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 21:54:37 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 276305
expires: Fri, 22 Jan 2021 05:35:18 GMT

GET
H2 200 input-prompt-metasploit-module-windows-credentials.png
pentestlab.files.wordpress.com/2020/02/ 242 KB
242 KB 141ms
137ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-windows-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

29532c4895317d4366fdb5033a2d0a3e41a47ac4016d9b6a08ac8b93d7e0735d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Feb 2020 22:08:51 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 247693
expires: Fri, 29 Jan 2021 16:15:10 GMT

GET
H2 200 input-prompt-lockphish.png
pentestlab.files.wordpress.com/2020/02/ 131 KB
131 KB 143ms
140ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

007f9000b001df68175e08d662a8cedea42ce260ad3a27caf9a12bb27eea7f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:46:00 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 134368
expires: Thu, 31 Dec 2020 20:38:06 GMT

GET
H2 200 input-prompt-lockphish-index.png
pentestlab.files.wordpress.com/2020/02/ 59 KB
59 KB 142ms
138ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-index.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e068cbd1a5f804a28437e1921388107353901c372fd553dd075517ffba9ecb63

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:48:45 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 60695
access-control-allow-credentials: true
expires: Sun, 10 Jan 2021 06:28:15 GMT

GET
H2 200 input-prompt-lockphish-lock-screen.png
pentestlab.files.wordpress.com/2020/02/ 154 KB
155 KB 141ms
138ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-lock-screen.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f1d7998f35c7e1f95a3c7276ae470ea7b94e24a45f7994078bfc5a628a0f6afc

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:50:09 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 158051
access-control-allow-credentials: true
expires: Wed, 20 Jan 2021 12:55:26 GMT

GET
H2 200 input-prompt-lockphish-redirection.png
pentestlab.files.wordpress.com/2020/02/ 562 KB
562 KB 143ms
140ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-redirection.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ca8af873c6dd216be263403f2fe055f46388e5531b9dc4b7942752c811feeeba

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:51:59 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 575265
expires: Tue, 05 Jan 2021 00:10:37 GMT

GET
H2 200 input-prompt-lockphish-credentials.png
pentestlab.files.wordpress.com/2020/02/ 146 KB
146 KB 572ms
569ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1ba8036645d489d08bb715521c376ca173d181f90a586d9480b182346f91f67a

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: EXPIRED hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:53:41 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 149657
expires: Sun, 31 Jan 2021 07:17:13 GMT

GET
H2 200 input-prompt-outlook-binary.png
pentestlab.files.wordpress.com/2020/02/ 139 KB
139 KB 142ms
139ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook-binary.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8e8b3a4cbef6794fbe7700bf5b561c5e28f9d21d71ee7667b3a9a27fb73e48bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:24:35 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 141903
expires: Mon, 04 Jan 2021 13:25:20 GMT

GET
H2 200 input-prompt-outlook.png
pentestlab.files.wordpress.com/2020/02/ 203 KB
203 KB 142ms
139ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook.png?w=1024

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f70be0d9a2465881cf543955038fa18bd32ade65189ffd4e008a3beb2ea47dda

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:26:28 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 207618
access-control-allow-credentials: true
expires: Thu, 28 Jan 2021 04:02:32 GMT

GET
H2 200 input-prompt-outlook-credentials.png
pentestlab.files.wordpress.com/2020/02/ 189 KB
189 KB 143ms
140ms Image
image/png 192.0.72.29
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook-credentials.png

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.29 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e801578e5cbc2637ac9f9762a2862e1a31061f0b0af5f30560c5d1bc52d07ac7

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 29 np
date: Mon, 28 Dec 2020 18:55:58 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 29 Feb 2020 11:29:03 GMT
server: nginx
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://pentestlab.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 193719
expires: Wed, 30 Dec 2020 19:01:36 GMT

GET
H2 200 ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 2 KB
2 KB 10ms
6ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 28 Dec 2020 18:55:58 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G>; rel="canonical"
content-length: 1792
expires: Mon, 28 Dec 2020 19:00:58 GMT

GET
H2 200 gprofiles.js Show response
0.gravatar.com/js/ 23 KB
7 KB 20ms
6ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=202053y
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 15:50:36 GMT
server: nginx
etag: W/"5e8609cc-5dea"
content-type: application/javascript
cache-control: max-age=604800
expires: Mon, 04 Jan 2021 18:55:58 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 582 B
388 B 9ms
9ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc65-2f0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:04 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 42 KB
11 KB 21ms
10ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1573483029j
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Mon, 11 Nov 2019 14:37:22 GMT
server: nginx
etag: W/"5dc97222-a830"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:05 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
646 B 16ms
15ms Script
text/javascript 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c04cbfe21e23ceb866fae28e981a17dfe9ce6cb178943dda6f11a495255ec137

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Mon, 28 Dec 2020 18:55:58 GMT

GET
H2 200 loading.gif
s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/ 2 KB
3 KB 14ms
12ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/loading.gif
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
x-ac: 2.hhn _dfw
last-modified: Mon, 07 Jan 2019 04:58:07 GMT
server: nginx
etag: "5c32dc5f-9e2"
content-type: image/gif
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2530
expires: Fri, 05 Nov 2021 08:08:07 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 38ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js?ver=20111117
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4188) /
Resource Hash: 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Dec 2020 18:55:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 21:52:09 GMT
Server: ECS (fcn/4188)
Age: 828
Etag: "a671d4d584ef50954e5cebb21da17065+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28698

GET
H2 200 / Show response
s0.wp.com/_static/ 28 KB
11 KB 20ms
10ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKiotzgjISczMo6qB+eWpRcEZqTk5QFPtc20NTc0NjAxMLC1MswAz32Jn
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 31f6f32679e3b161ac5e00a81f92df3566541e40866972decdb4a0c688d99783

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Fri, 04 Oct 2019 16:03:14 GMT
server: nginx
etag: W/"5d976d42-7195"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:42:17 GMT

GET
H2 200 /
s0.wp.com/_static/ 23 KB
4 KB 21ms
11ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxty0sKgCAQANALZVOCUYvoLDINofnDUbt+tGjn9sGDJwmMoVAo4KtIrl4mMGTiFAObRqKZk2JHRmQeoN9R51iZHFgqSeMtfvjS4fdZbVItk1ylfQGmXDAD?cssminify=yes
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: ae1f1619b28f9f156bc8837bf3beda0f1ec2501ba7be2d9bba77a7d9393416cc

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Fri, 19 Jun 2020 09:51:32 GMT
server: nginx
etag: W/"5eec8aa4-5bae"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:09:47 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 142 KB
37 KB 20ms
11ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNkdFSwyAQRX9IslbbjC+On+IQ2CabAIsspNavl3aaGTWd1idg957LXoBDVIZDxpBhFLA4k8H42YzyAL9bkSV7FNE9XumOHwXT8bI0FGbCw13ZiDlqM6mEQl8rV19UdKWnIOBoQoEKFRx0sA7TX/GiNNw5NpPAU7NrnsGSnO9dyspRP+SOVwHzgDUcxISeij8d91zSCQ16pl5n4vB/RkyimBc9BeOKrcrzIN5XtkaO7th4Wpn+SH15HnivBrDXBjvmSaHv0N6gtK2uqtMJvJaMqe5UTtVHbkD1ByIHoRnVTBb5SuXOsEYnLoJumVothcq8+ddN+/iyadvtdjd+A0BJ62Q=
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 253eb2edf44c27bfee735f4c0a6c38f8092bfb12ee9ecd69c865cac79a731aae

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Thu, 17 Dec 2020 00:54:52 GMT
server: nginx
etag: W/"5fdaac5c-237c9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Tue, 21 Dec 2021 13:52:13 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 15 KB
4 KB 511ms
158ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
last-modified: Tue, 18 Feb 2020 17:20:32 GMT
server: nginx
etag: W/"5e4c1ce0-3b42"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Wed, 27 Jan 2021 18:55:59 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 23 KB
6 KB 20ms
11ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/akismet-3.0/_inc/form.js,/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1607424465j
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 1f5658a8491ff91d14ca2a82db180d774e46af53987e64427f9bcfd833d34f5c

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
last-modified: Tue, 08 Dec 2020 10:48:40 GMT
server: nginx
etag: W/"5fcf5a08-5bad"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Wed, 08 Dec 2021 10:49:01 GMT

GET
H2 200 w.js Show response
stats.wp.com/ 13 KB
5 KB 26ms
8ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?61
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5e6029bb-4e62"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
expires: Fri, 05 Nov 2021 08:08:05 GMT

GET
H2 200 MqLTUZBEliE
www.youtube.com/embed/ Frame 24E9 0
0 132ms
128ms Document
text/html 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/MqLTUZBEliE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/MqLTUZBEliE?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en&autohide=2&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
content-type: text/html; charset=utf-8
cache-control: no-cache
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-length: 9039
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date: Mon, 28 Dec 2020 18:55:58 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=MgfnuEa5YqY; path=/; domain=.youtube.com; secure; expires=Sat, 26-Jun-2021 18:55:58 GMT; httponly; samesite=None VISITOR_INFO1_LIVE=MgfnuEa5YqY; path=/; domain=.youtube.com; secure; expires=Sat, 26-Jun-2021 18:55:58 GMT; httponly; samesite=None YSC=GRyHRsgz_Mc; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Mon, 28-Dec-2020 19:25:58 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 header.jpg
s0.wp.com/wp-content/themes/premium/thefour/img/ 200 KB
200 KB 13ms
13ms Image
image/jpeg 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/img/header.jpg
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
x-ac: 2.hhn _dfw
last-modified: Sat, 31 Dec 2016 05:39:07 GMT
server: nginx
etag: "5867447b-31e2d"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 204333
expires: Fri, 05 Nov 2021 09:52:19 GMT

GET
H2 200 JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v15/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTURjIg1_i6t8kCHKm45_ZpC3gnD_vx3rCs.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=5.6-RC5-49737

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://fonts.googleapis.com/css?family=Open%2BSans%3A400%2C400italic%2C700%2C700italic%7CMontserrat%3A500&subset=latin%2Clatin-ext&ver=5.6-RC5-49737
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Dec 2020 22:53:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:07 GMT
server: sffe
age: 590571
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13640
x-xss-protection: 0
expires: Tue, 21 Dec 2021 22:53:07 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Origin: https://pentestlab.blog
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 button-back.gif
s0.wp.com/wp-content/mu-plugins/highlander-comments/images/ 1 KB
1 KB 10ms
9ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/images/button-back.gif
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35

Request headers

Referer: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
x-ac: 2.hhn _dfw
last-modified: Sat, 31 Dec 2016 05:32:48 GMT
server: nginx
etag: "58674300-4d0"
content-type: image/gif
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1232
expires: Fri, 05 Nov 2021 08:08:06 GMT

GET
H2 200 fontawesome-webfont.woff2
s0.wp.com/wp-content/themes/premium/thefour/fonts/ 70 KB
70 KB 318ms
12ms Font
application/font-woff2 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/themes/premium/thefour/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyNkEEOwjAMBD+ECUUUqQfEW0Jwg6kTV3Giwu9JuaAKqXDbsXb2YDON4CRmjNnkGwZUMyYMVMKMvZRknKrpawXshCoBt/WwMb89zU/+LocCIxdPUc1EV4+5jluHF5EBmIYaHv+bKo4sA9XKEtZkjwIszmaSuADo2VJaUxNeWHyN/v2VD87SOZyatmu7/bHZHe4vDS2BuQ==?cssminify=yes
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Origin: https://pentestlab.blog
Referer: https://s0.wp.com/_static/??-eJyNkEEOwjAMBD+ECUUUqQfEW0Jwg6kTV3Giwu9JuaAKqXDbsXb2YDON4CRmjNnkGwZUMyYMVMKMvZRknKrpawXshCoBt/WwMb89zU/+LocCIxdPUc1EV4+5jluHF5EBmIYaHv+bKo4sA9XKEtZkjwIszmaSuADo2VJaUxNeWHyN/v2VD87SOZyatmu7/bHZHe4vDS2BuQ==?cssminify=yes
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 28 Dec 2020 18:55:59 GMT
x-ac: 2.hhn _dca
last-modified: Thu, 29 Nov 2018 14:00:18 GMT
server: nginx
etag: "5bfff0f2-118d8"
access-control-allow-methods: GET, HEAD
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 71896
expires: Fri, 05 Nov 2021 08:17:55 GMT

GET
H2 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 51ms
39ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5bf332a5-1995"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:54 GMT

GET
H2 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
510 B 51ms
39ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&ver=3.0.9b
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:58 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc5b-b3d"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:54 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 12ms
5ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyNkdFSwyAQRX9IslbbjC+On+IQ2CabAIsspNavl3aaGTWd1idg957LXoBDVIZDxpBhFLA4k8H42YzyAL9bkSV7FNE9XumOHwXT8bI0FGbCw13ZiDlqM6mEQl8rV19UdKWnIOBoQoEKFRx0sA7TX/GiNNw5NpPAU7NrnsGSnO9dyspRP+SOVwHzgDUcxISeij8d91zSCQ16pl5n4vB/RkyimBc9BeOKrcrzIN5XtkaO7th4Wpn+SH15HnivBrDXBjvmSaHv0N6gtK2uqtMJvJaMqe5UTtVHbkD1ByIHoRnVTBb5SuXOsEYnLoJumVothcq8+ddN+/iyadvtdjd+A0BJ62Q=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef8e29dd2536c64e57546acf21bf8e5cb6c15b2ad83e713d0065981a7d0c0133

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: P/CxX790y7r+gzuZlCaGag==
cross-origin-resource-policy: cross-origin
expires: Mon, 28 Dec 2020 19:05:15 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1781
x-fb-rlafr: 0
x-fb-debug: IMPzcoi6CucOj+qi5904s2OQgIK07Gz9BRPfW5QTZ9OsJNn6XS6LUMYKC66s4eo7spbUMOXD/w1J/GLG8nQ77Q==
x-fb-trip-id: 436667874
x-fb-content-md5: cd7ecfd19e6cc8aee40665700a6eaa28
date: Mon, 28 Dec 2020 18:55:58 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "3efe1eeb04709a822576092ca04f730f"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H3-Q050 200 css
fonts.googleapis.com/ 7 KB
1 KB 47ms
28ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

862f79c7b5cd8cfbff0673aa57ef871127789936d9f27f6f900816cf2998cc37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 28 Dec 2020 18:55:58 GMT
server: ESF
date: Mon, 28 Dec 2020 18:55:58 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 28 Dec 2020 18:55:58 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/ 334 KB
131 KB 12ms
5ms Script
text/javascript 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fb3b275e8321c2c87095a4f4f0fd89fbbbdbe07e6fd5191c4c8ccabfc21692fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:40:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 952
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133916
x-xss-protection: 0
last-modified: Sun, 06 Dec 2020 23:05:51 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 28 Dec 2021 18:40:06 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 195 KB
59 KB 53ms
40ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=197224456ac898f73c0d8de59dfb9d6b&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bbb8102b68d3f82a57efb341a0a95a1b22986d1c3f48891227d83b27cb47736c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://pentestlab.blog
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 39+5fDq9rtq93RsFMnPTug==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 60132
x-fb-rlafr: 0
x-fb-debug: Bwobya1s8Jnh3VnciBXmlTXpztReLoc/xQsTvcmARFdXPvwM/6HhTJVG/QYduvHCR11BC+ppgZ7R/sNE/wOgRw==
x-fb-trip-id: 436667874
x-fb-content-md5: 9589bb193ee157f8e0283f62fb6c1c7b
x-frame-options: DENY
date: Mon, 28 Dec 2020 18:55:58 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "76ab58a9daf3cbff0d9bcce9a76405a7"
timing-allow-origin: *
expires: Tue, 28 Dec 2021 18:21:35 GMT

GET
H3-Q050 200 4iCs6KVjbNBYlgoKfw72nU6AFw.woff2
fonts.gstatic.com/s/ubuntu/v15/ 13 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCs6KVjbNBYlgoKfw72nU6AFw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Dec 2020 17:10:16 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:03:01 GMT
server: sffe
age: 524742
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13720
x-xss-protection: 0
expires: Wed, 22 Dec 2021 17:10:16 GMT

GET
H3-Q050 200 4iCu6KVjbNBYlgoKej70l0miFYxn.woff2
fonts.gstatic.com/s/ubuntu/v15/ 14 KB
14 KB 44ms
42ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCu6KVjbNBYlgoKej70l0miFYxn.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dce569cc963341079475e7e09383868af54d13d40e3e1bb47a50e6e203cacf64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Dec 2020 18:13:13 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:02:51 GMT
server: sffe
age: 434565
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14148
x-xss-protection: 0
expires: Thu, 23 Dec 2021 18:13:13 GMT

GET
H3-Q050 200 4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2
fonts.gstatic.com/s/ubuntu/v15/ 14 KB
14 KB 44ms
42ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCv6KVjbNBYlgoCxCvjsGyNPYZvgw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

251e8e864140d9a7ceacce3371ff692595dd0a455ad000de4041d8a313618bd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Dec 2020 02:09:38 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:03:11 GMT
server: sffe
age: 319580
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14096
x-xss-protection: 0
expires: Sat, 25 Dec 2021 02:09:38 GMT

GET
H3-Q050 200 4iCp6KVjbNBYlgoKejZPslyPN4FNgYUJ.woff2
fonts.gstatic.com/s/ubuntu/v15/ 15 KB
15 KB 44ms
43ms Font
font/woff2 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCp6KVjbNBYlgoKejZPslyPN4FNgYUJ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8e24b2d7ac47818c18b9dd522bcf423301a39c6ed5218fe5115d4318fa5d5d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlab.blog
Referer: https://fonts.googleapis.com/css?family=Ubuntu:r,i,b,bi%7CUbuntu:r&subset=latin,latin-ext,latin,latin-ext
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Dec 2020 21:31:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:02:44 GMT
server: sffe
age: 249891
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14924
x-xss-protection: 0
expires: Sat, 25 Dec 2021 21:31:07 GMT

GET
H2 200 page.php
www.facebook.com/v2.3/plugins/ Frame 956D 0
0 71ms
71ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df231dd82ecbe1fc%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=197224456ac898f73c0d8de59dfb9d6b&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df231dd82ecbe1fc%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=342&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.2
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
x-fb-rlafr: 0
content-type: text/html; charset="utf-8"
x-fb-debug: uSGAf04YpzYTc5GrnJz60Opn9yeEQJBi/cO551HTvPD3L4AcOa7QCXM6bLn8ClNPNDwgDpaCkeaXulLWpwCm1g==
date: Mon, 28 Dec 2020 18:55:59 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 1 KB
451 B 182ms
162ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=5556500&uid=wp-post-27695&item_id=_post_27695
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 9a9003e77b35aca2a34cacd02ffe8db760c230d7a15703739cea6f8356845eb0

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 master.html
widgets.wp.com/likes/ Frame EB5E 0
0 8ms
6ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=20200826
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=20200826
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

server: nginx
date: Mon, 28 Dec 2020 18:55:59 GMT
content-type: text/html
last-modified: Wed, 26 Aug 2020 21:12:41 GMT
vary: Accept-Encoding
etag: W/"5f46d049-84e"
content-encoding: gzip
x-ac: 2.hhn _dfw
x-nc: HIT hhn 2

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 12ms
10ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.6757406236283963
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 11ms
9ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=32637504&v=wpcom&tz=0&user_id=0&post=27695&subd=pentestlab&host=pentestlab.blog&ref=&fcp=1094&rand=0.9836726506156015
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 10ms
8ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29%2BSmw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8%2FMkNtblkvY1dzRllmL3pDc1daMWIyayxvaytjJUsudnFyWDA4RlpSSmYuWFd%2BLTA3JmcuM01bZi1WVX5HZXVkekhMU25VTHx%2BNm5bL1AwVERsPTY1b3IlcEZPWS5wblt1REJlTmVBRnhKQy5VUT1Zd0t3UVlzQSxMRGZ2SjFEdGEzd0dhc0wyM255UFNuaFNsd1pCN3BbcU1aTD1iQ3ZsX05DUXwmWEM5R2pqM0QyMz1qQUh2ekJ%2Bd2UmJj8rfHg0Zll4JnQlQzJ6dFNiRjhBVnw3MGpyVzJGbXhlPVg3NVZKT3ozfC9%2BTT9GUCZBZCs9MF82JXNxTlc0OEdpWGp4WVRIVSUufmUmNX5GfGlETXlbRXZKPUU3U2dnLm5%2BWVlrPXlqSm45&v=wpcom-no-pv&rand=0.6870443787459428
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 2705.svg
s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/ 482 B
622 B 8ms
7ms Image
image/svg+xml 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/2705.svg
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 1f026beb67630abcdbc341651b1c17591aa76261296a9fb118793765964eb4e9

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:59 GMT
x-ac: 2.hhn _dfw
last-modified: Thu, 25 Jun 2020 06:14:43 GMT
server: nginx
etag: "5ef440d3-1e2"
access-control-allow-methods: GET, HEAD
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 482
expires: Fri, 05 Nov 2021 08:19:54 GMT

GET
H2 200 / Show response
pentestlab.blog/2020/03/02/phishing-windows-credentials/ 2 KB
1 KB 284ms
282ms XHR
application/json 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlab.blog/2020/03/02/phishing-windows-credentials/?relatedposts=1

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/mobile-useragent-info.js,/wp-includes/js/jquery/jquery.js,/wp-content/mu-plugins/related-posts/related-posts.js?m=1608135399j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e343a84f42bda4fb142c794e853f4a0bd9af5d8c0c8758b398bbd46c96e2e890

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
date: Mon, 28 Dec 2020 18:55:59 GMT
x-pingback: https://pentestlab.blog/xmlrpc.php
content-type: application/json; charset=utf-8
x-ac: 2.hhn _dfw
vary: Accept-Encoding

GET
H2 200 hovercard.min.css
0.gravatar.com/dist/css/ 8 KB
2 KB 6ms
5ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/hovercard.min.css?ver=202053y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202053y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 15:57:10 GMT
server: nginx
etag: W/"5fac09d6-1e86"
content-type: text/css
cache-control: max-age=604800
expires: Mon, 04 Jan 2021 18:55:59 GMT

GET
H2 200 services.min.css
0.gravatar.com/dist/css/ 3 KB
587 B 6ms
5ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/services.min.css?ver=202053y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202053y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
cache-control: max-age=604800
expires: Mon, 04 Jan 2021 18:55:59 GMT

GET
H/1.1 200
OK widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame 815A 0
0 9ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fpentestlab.blog
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40E2) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 861573
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 28 Dec 2020 18:55:59 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Thu, 01 Oct 2020 21:50:01 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40E2)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H2 200 count.json Show response
api.pinterest.com/v1/urls/ 121 B
366 B 146ms
118ms Script
application/javascript 104.75.88.209
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/akismet-3.0/_inc/form.js,/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1607424465j

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.209 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-209.deploy.static.akamaitechnologies.com

Software

Resource Hash

791299016d1f96d1dfac648d523373708ba69eac71db3905aa9b735babfb6cf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
x-content-type-options: nosniff
x-cdn: akamai
age: 0
content-type: application/javascript
access-control-allow-origin: *
cache-control: private
x-envoy-upstream-service-time: 2
x-pinterest-rid: 8635551311408272
content-length: 121
expires: Mon, 28 Dec 2020 19:10:59 GMT

GET
H2 200 / Show response
graph.facebook.com/ 244 B
629 B 53ms
26ms Script
text/javascript 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/akismet-3.0/_inc/form.js,/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1607424465j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d3faa649403506dca18bef9c5d4a0be00832e680390c81b84aab351d902a6aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1003139614
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 183
pragma: no-cache
x-fb-debug: UNj5yGMWXw1XT2f7Ww9pDwsXRL8e/gOPvQ3Vpiug/Vku/U5hP6jXZeYzyU358f8OiStXVqJ9r0akIwjGrOKDUw==
x-fb-trace-id: He4vupu7mti
date: Mon, 28 Dec 2020 18:55:59 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: A90wLsjTVj3QZ5Fwloz4Xyx
cache-control: no-store
facebook-api-version: v3.2
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 11ms
7ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.5886159093818686
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 13ms
9ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.2272372370368747
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 remote-login.php
r-login.wordpress.com/ Frame FB94 0
0 184ms
138ms Document
text/html 192.0.78.18
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1609181757

Requested by

Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.18 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: r-login.wordpress.com
:scheme: https
:path: /remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1609181757
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

server: nginx
date: Mon, 28 Dec 2020 18:55:59 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Cookie
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: gzip
x-ac: 1.hhn _dfw
strict-transport-security: max-age=15552000

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 3D98 0
0 83ms
39ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=qc5B-qjP0QEimFYUxcpWJy5B&theme=light&size=normal&cb=l5agw9721fsk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-RPexPOw0iJ84OXJ0r48izw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=qc5B-qjP0QEimFYUxcpWJy5B&theme=light&size=normal&cb=l5agw9721fsk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 28 Dec 2020 18:55:59 GMT
content-security-policy: script-src 'report-sample' 'nonce-RPexPOw0iJ84OXJ0r48izw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10936
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK button.63c51c903061d0dbd843c41e8a00aa5a.js Show response
platform.twitter.com/js/ 7 KB
3 KB 47ms
8ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.63c51c903061d0dbd843c41e8a00aa5a.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4188) /
Resource Hash: e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Dec 2020 18:55:59 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 21:49:51 GMT
Server: ECS (fcn/4188)
Age: 861572
Etag: "62d4b0301f07768d13f3ee5de8633739+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2294

GET
H2 200 index.html
widgets.wp.com/likes/ Frame E6FD 0
0 7ms
6ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/index.html?ver=20200826
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/mobile-useragent-info.js,/wp-includes/js/jquery/jquery.js,/wp-content/mu-plugins/related-posts/related-posts.js?m=1608135399j
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/index.html?ver=20200826
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

server: nginx
date: Mon, 28 Dec 2020 18:55:59 GMT
content-type: text/html
content-length: 126
last-modified: Sat, 23 Dec 2017 00:24:47 GMT
etag: "5a3da24f-7e"
x-ac: 2.hhn _dfw
x-nc: HIT hhn 2
accept-ranges: bytes

GET
H2 200 star-yellow-sml.png
polldaddy.com/images/ratings/ 3 KB
3 KB 163ms
162ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
last-modified: Thu, 24 Dec 2015 22:38:23 GMT
server: nginx
etag: "567c73df-c0d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3085
expires: Wed, 27 Jan 2021 18:55:59 GMT

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 164ms
163ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
last-modified: Thu, 24 Dec 2015 22:38:00 GMT
server: nginx
etag: "567c73c8-4ca"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1226
expires: Wed, 27 Jan 2021 18:55:59 GMT

GET
H2 200 page.php
www.facebook.com/v2.3/plugins/ Frame C234 0
0 65ms
65ms Document
text/html 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2d42aa437df%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=0&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=197224456ac898f73c0d8de59dfb9d6b&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2d42aa437df%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3bf4976220d4a%26relation%3Dparent.parent&container_width=0&height=432&hide_cover=false&hide_cta=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&small_header=false&tabs=false&width=200
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.2
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
x-fb-rlafr: 0
content-type: text/html; charset="utf-8"
x-fb-debug: Oe7Fx5Jfu9WRHTK0CJzcy9hMoaiklnuqCwq353Okhnxoz6ZKaUTVba1+MuDjUej9JCBeSuFD0RxNXM2CpJdbQw==
date: Mon, 28 Dec 2020 18:55:59 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H/1.1 200
OK follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
platform.twitter.com/widgets/ Frame A84F 0
0 61ms
58ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.96fd96193cc66c3e11d4c5e4c7c7ec97.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4188) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 861572
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 28 Dec 2020 18:55:59 GMT
Etag: "fa16f6b5a5d1ee2100b485fa457112a6+gzip"
Last-Modified: Thu, 01 Oct 2020 21:49:53 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/4188)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 13661

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame A978 0
0 17ms
16ms Document
text/html 2a00:1450:4001:814::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=xiiq4k13auli

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hxg5p8/RDEnbUoedDFdkDg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=xiiq4k13auli
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 28 Dec 2020 18:55:59 GMT
content-security-policy: script-src 'report-sample' 'nonce-hxg5p8/RDEnbUoedDFdkDg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1122
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 12 KB
3 KB 7ms
6ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20201002
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 567b9db6dae11476eddb5328bfcd2977e165f2a9bee36c417ba5b4a47265e99a

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
server: nginx
etag: W/"5f88539e-376b"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:05 GMT

GET
H2 200 actionbar.js Show response
s0.wp.com/wp-content/mu-plugins/actionbar/ 15 KB
5 KB 7ms
7ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20201002
Requested by: Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d4d250af967a07b7066ef13b91d26e5fe9177fbd3f29b137186b1c35a2afd1c

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
server: nginx
etag: W/"5f88539e-4f45"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
x-ac: 2.hhn _dfw
expires: Fri, 05 Nov 2021 08:08:05 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
337 B 131ms
131ms Image
image/gif 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22wordpressdotcom%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1609181759693%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22ed20a2b%3A1601588405575%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 28 Dec 2020 18:55:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Mon, 28 Dec 2020 18:55:59 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e6026e17b854e268cfbd12b72e800a0b
x-transaction: 0051e746008eb40f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 9ms
9ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

Referer: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Mon, 28 Dec 2020 18:55:59 GMT
x-ac: 2.hhn _dfw
last-modified: Wed, 23 Nov 2016 19:27:32 GMT
server: nginx
etag: "5835eda4-200b"
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8203
expires: Fri, 05 Nov 2021 08:08:05 GMT

Verdicts & Comments Add Verdict or Comment

122 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: GRyHRsgz_Mc
			.youtube.com/	1970-01-19 19:18:53	Name: VISITOR_INFO1_LIVE Value: MgfnuEa5YqY

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
api.pinterest.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
pentestlab.blog
pentestlab.files.wordpress.com
pixel.wp.com
platform.twitter.com
polldaddy.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
syndication.twitter.com
widgets.wp.com
www.facebook.com
www.google.com
www.gstatic.com
www.youtube.com
104.244.42.8
104.75.88.209
192.0.123.248
192.0.72.29
192.0.76.3
192.0.77.32
192.0.78.18
192.0.78.25
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:814::2004
2a00:1450:4001:81d::200a
2a00:1450:4001:81e::2003
2a00:1450:4001:825::2003
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:e:face:b00c:0:2
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
007f9000b001df68175e08d662a8cedea42ce260ad3a27caf9a12bb27eea7f99
00db98b9eee1771f3cc2d7124438f103cfdf17fb4b46b3d3fa0962615d27e908
03d1076123112f8b3de7daaabeb7e4df9147a4d20feca5597c40dd62eca16791
08ac71341cf5d9e4804399f091ce495533990f6088fdf4064a3c91b1294ca4dd
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d
1ba8036645d489d08bb715521c376ca173d181f90a586d9480b182346f91f67a
1f026beb67630abcdbc341651b1c17591aa76261296a9fb118793765964eb4e9
1f16434d944a6e996c5b5bf08d9061ee33eaf68dbd2f4f8f786e159f7dc5cae6
1f5658a8491ff91d14ca2a82db180d774e46af53987e64427f9bcfd833d34f5c
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb
251e8e864140d9a7ceacce3371ff692595dd0a455ad000de4041d8a313618bd7
253eb2edf44c27bfee735f4c0a6c38f8092bfb12ee9ecd69c865cac79a731aae
25510b668f142f8d9acf744481b110f3d2790835c0f336433aaff694610e03ab
29532c4895317d4366fdb5033a2d0a3e41a47ac4016d9b6a08ac8b93d7e0735d
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
2b9e020056bd63eec5d5905d220780d2036ec776595cdf83eef9de3cb191366f
3192730e0123148fb8c0c2351fd47683b4c3927a4e59be58eb923813496c49db
31f6f32679e3b161ac5e00a81f92df3566541e40866972decdb4a0c688d99783
3685c3818240f5f390073c7d04f944a5cb5d848093224f3a7888034e8c050eb4
3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2
3922421878d5b0f7af38a59193191202c018da5e10fdcae3ef58f2abf360c6b8
393a213ef00f9d5ec1c6a3f26f4ee9f809ff5b9d74a58c8a6419a9ac96515bf5
3b5803d4f600ba6f07f7d802daeae542dbde291aa3b1d170954ef7f5ac569563
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558
4e3c26b195de4359f1bf3711f15b4858015b006556c8e2af5c6df627a0959f7d
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0
567b9db6dae11476eddb5328bfcd2977e165f2a9bee36c417ba5b4a47265e99a
61c52736ce8a30fc80ee898ba252d0c8f3587f7abea693d7fbae60675651cdcb
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
6d42849613c979cbd20fa9b2bc66f99ad8dad334299252851fce918531e599fb
72f6111c826a30ccd1f165810abe57ede94f3e780e3cfb3e706cd08ccde1c14e
753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b
791299016d1f96d1dfac648d523373708ba69eac71db3905aa9b735babfb6cf2
7cc264e349679f450869ba46c806ba0dbf5a525bf9eb388433ecf05bd8d06093
7d4d250af967a07b7066ef13b91d26e5fe9177fbd3f29b137186b1c35a2afd1c
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8269e79540b61f9c52daeccf593070340da1bc8a67330476f4870f4ec7722503
862f79c7b5cd8cfbff0673aa57ef871127789936d9f27f6f900816cf2998cc37
877a42370ac831903fd5ed13b7882111d4f69e67e7db541c18893cfa9da3e7d1
893a7a315254505f93d4c92ada4651a29eab01b5f46047c15ebf8dedca408414
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3
8d13ae92ee8e79364a4e3a5eb49b6eecee7b5886faece5c207ca03461af6c36b
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8e8b3a4cbef6794fbe7700bf5b561c5e28f9d21d71ee7667b3a9a27fb73e48bd
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
943a150e9577247cc5e8e493065795ca77a35485b4169f33a4d6f570c209b010
9717a8ee8bbe0c7d99fbba9bf7a74fc24ba7e9361221f54ca333ee30e54f4474
9a9003e77b35aca2a34cacd02ffe8db760c230d7a15703739cea6f8356845eb0
9ab3c9f66c0999e264a5756cb47752a136162aa7cfb8ddadf88dbc9a9a172c0b
a17e2f9f05d01c0bbbe018eaa6bb91113a5b253e3f0de4719969dc936f9d5e49
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae1f1619b28f9f156bc8837bf3beda0f1ec2501ba7be2d9bba77a7d9393416cc
b5c11890fda6432b21e85c6d39487c18e36d278facc0f19dcb257e736d5bb7c3
bb0ad39a956ea689a5f992ce22ee39329ef342c9e18c9679904c56d7aebaf96c
bbb8102b68d3f82a57efb341a0a95a1b22986d1c3f48891227d83b27cb47736c
bec55f93f48d9f10c9899d4755533c197768f85046999c01a14ce8fc059e7393
c04cbfe21e23ceb866fae28e981a17dfe9ce6cb178943dda6f11a495255ec137
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c6453de2cc28ace38af345b6caba817ace52d1d102e213c3a1950b351ad8a035
ca8af873c6dd216be263403f2fe055f46388e5531b9dc4b7942752c811feeeba
cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5
cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615
cba32f71b1e21bb69ee0e7a94b68b7c63c95957fbd1a561c19eb9fe0f5e9c2da
cc11081dbad9f1e7a88a835a060df43518342f9e727b5abd91d0d422137d1dfc
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
cedb226bd7759d04b58baa1a609e1aeecc1aa5c6c3280c4db153019f426f3de0
d3faa649403506dca18bef9c5d4a0be00832e680390c81b84aab351d902a6aba
dce569cc963341079475e7e09383868af54d13d40e3e1bb47a50e6e203cacf64
e068cbd1a5f804a28437e1921388107353901c372fd553dd075517ffba9ecb63
e0a70c5d116d9c823c7d7958ecea2a7926315fac156e390bd7dc8a5fa088cdc3
e343a84f42bda4fb142c794e853f4a0bd9af5d8c0c8758b398bbd46c96e2e890
e6d170af18ce67bba11e319fb3abd1356b3d9bdfc299c6df50b9fe789912ba7b
e801578e5cbc2637ac9f9762a2862e1a31061f0b0af5f30560c5d1bc52d07ac7
e8e24b2d7ac47818c18b9dd522bcf423301a39c6ed5218fe5115d4318fa5d5d4
e8e37a38074c0878aa6615f997afd39b90e269251dde584c70ee790778cd9af1
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ef8e29dd2536c64e57546acf21bf8e5cb6c15b2ad83e713d0065981a7d0c0133
f1d7998f35c7e1f95a3c7276ae470ea7b94e24a45f7994078bfc5a628a0f6afc
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f
f70be0d9a2465881cf543955038fa18bd32ade65189ffd4e008a3beb2ea47dda
fb3b275e8321c2c87095a4f4f0fd89fbbbdbe07e6fd5191c4c8ccabfc21692fb

pentestlab.blog Open in urlscan Pro 192.0.78.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

97 Requests

100 %HTTPS

58 %IPv6

13 Domains

21 Subdomains

20 IPs

4 Countries

7237 kBTransfer

8439 kBSize

2 Cookies

39 Outgoing links

Redirected requests

97 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pentestlab.blog Open in urlscan Pro
192.0.78.25 Public Scan

Screenshot
Live screenshot

Full Image

97
Requests

100 %
HTTPS

58 %
IPv6

13
Domains

21
Subdomains

20
IPs

4
Countries

7237 kB
Transfer

8439 kB
Size

2
Cookies

97 HTTP transactions
1 data transactions