urlscan.io logo urlscan.io
SecurityTrails logo

redcursor.com.au Open in urlscan Pro
141.193.213.20  Public Scan

Go To Rescan Add Verdict Report
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Submission: On May 26 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 43 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is redcursor.com.au.
TLS certificate: Issued by R3 on March 21st 2022. Valid for: 3 months.
This is the only time redcursor.com.au was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
37 141.193.213.20 209242 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:401... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
43 5
37    141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
redcursor.com.au
1    2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a00:1450:4014:80b::2003 (Ireland)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
Apex Domain
Subdomains		 Transfer
37 redcursor.com.au
redcursor.com.au
1 MB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
2 gstatic.com
fonts.gstatic.com
32 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42
933 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
39 KB
43 5
Domain Requested by
37 redcursor.com.au redcursor.com.au
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com redcursor.com.au
1 www.googletagmanager.com redcursor.com.au
43 5

This site contains links to these domains. Also see Links.

Domain
github.com
twitter.com
www.linkedin.com
omnihyper.com
Subject Issuer Validity Valid
redcursor.com.au
R3		 2022-03-21 -
2022-06-19		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Frame ID: 031E9D290D1731A13374E8A5A41B539D
Requests: 43 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Bypassing CrowdStrike Endpoint Detection and Response - Red Cursor

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googleapis\.com/.+webfont
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

43
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

1259 kB
Transfer

1827 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

43 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/ 		52 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
a42385cb75bd932299bc874f54a779a447fd688a6ff74be2d7f96c26779b6a5b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
711a297a1b859b39-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 26 May 2022 23:06:34 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
link
<https://redcursor.com.au/wp-json/>; rel="https://api.w.org/" <https://redcursor.com.au/wp-json/wp/v2/posts/152>; rel="alternate"; type="application/json" <https://redcursor.com.au/?p=152>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
MISS
x-cache-group
normal
x-cacheable
SHORT
x-powered-by
WP Engine
style.min.css
redcursor.com.au/wp-includes/css/dist/block-library/ 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 30 Mar 2022 11:30:25 GMT
server
cloudflare
etag
W/"62443f51-145db"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a297ffd1e9b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
styles-blocks.css
redcursor.com.au/wp-content/plugins/prismatic/css/ 		526 B
423 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/prismatic/css/styles-blocks.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 17 May 2022 20:19:06 GMT
server
cloudflare
etag
W/"6284033a-20e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a297ffd209b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
styles.css
redcursor.com.au/wp-content/plugins/contact-form-7/includes/css/ 		3 KB
1003 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.6.1
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 May 2022 19:13:43 GMT
server
cloudflare
etag
W/"62854567-aab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d239b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
aos.css
redcursor.com.au/wp-content/plugins/cvw-pb-animation/ 		25 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/cvw-pb-animation/aos.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a6eebc36e4a57718c790fe3f3068cf8a6c1d7c1280e7c69bbf8d19939a5f632

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 11 Apr 2022 21:22:47 GMT
server
cloudflare
etag
W/"62549c27-659d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d259b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
spam-protect-for-contact-form7.css
redcursor.com.au/wp-content/plugins/wp-contact-form-7-spam-blocker/frontend/css/ 		98 B
155 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/wp-contact-form-7-spam-blocker/frontend/css/spam-protect-for-contact-form7.css?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 27 Feb 2022 18:35:07 GMT
server
cloudflare
etag
W/"621bc45b-62"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d269b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
redcursor.com.au/wp-content/themes/twentytwentyone/ 		152 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/twentytwentyone/style.css?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
911c68ef3d2106a0b2295297caf1813e616ca53e9c7bf6bb8f003371f5c1ed5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 03 Aug 2021 02:55:38 GMT
server
cloudflare
etag
W/"6108b02a-261f9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d279b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
compiled.css
redcursor.com.au/wp-content/themes/traff1k/ 		33 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/compiled.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e405a026e7ce6e9e32733088d95c529ada4596ae3ba80c19fce9bcbfd0fb43ae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Aug 2021 06:37:43 GMT
server
cloudflare
etag
W/"612c7cb7-841e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d289b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
redcursor.com.au/wp-content/themes/traff1k/ 		10 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/style.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
58af6e63322e8e4a9fc700b7f56c3052e269ca5d5ab164513870d7b4950e1131

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 17 Aug 2021 02:07:34 GMT
server
cloudflare
etag
W/"611b19e6-28eb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d299b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.css
redcursor.com.au/wp-content/themes/traff1k/assets/css/ 		72 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/assets/css/all.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5ad31a47913cdfc2470acd4e304982fae2bccf62098855fecf3b84c1e7fea34

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 24 Jun 2021 00:58:28 GMT
server
cloudflare
etag
W/"60d3d8b4-11f99"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d2a9b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
mailin-front.css
redcursor.com.au/wp-content/plugins/mailin/css/ 		3 KB
792 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/mailin/css/mailin-front.css?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c288f0c3cb0999bbd6a9f6486f6b13064ead24052234ac35f8b053b9db9ae96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 26 May 2022 19:28:30 GMT
server
cloudflare
etag
W/"628fd4de-a79"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d2b9b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery.min.js
redcursor.com.au/wp-includes/js/jquery/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 10 Mar 2021 15:07:24 GMT
server
cloudflare
etag
W/"6048e0ac-15db1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d2f9b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-migrate.min.js
redcursor.com.au/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 Nov 2020 09:06:06 GMT
server
cloudflare
etag
W/"5fb4e3fe-2bd8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d309b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
spam-protect-for-contact-form7.js
redcursor.com.au/wp-content/plugins/wp-contact-form-7-spam-blocker/frontend/js/ 		838 B
556 B 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/wp-contact-form-7-spam-blocker/frontend/js/spam-protect-for-contact-form7.js?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Sun, 27 Feb 2022 18:35:07 GMT
server
cloudflare
etag
W/"621bc45b-346"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d329b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
mailin-front.js
redcursor.com.au/wp-content/plugins/mailin/js/ 		12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/mailin/js/mailin-front.js?ver=1653593310
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8469ad6e03ba1a6c2c9fee151001c818233baff45efada0b93f6d864c21dbb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 26 May 2022 19:28:30 GMT
server
cloudflare
etag
W/"628fd4de-2fe7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29800d339b39-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
js
www.googletagmanager.com/gtag/ 		100 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-119466155-1
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a28fcee44d2b8c2706855b35e5b9b9e49008514aa65163615d710a097f94c63e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39564
x-xss-protection
0
last-modified
Thu, 26 May 2022 21:39:50 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 26 May 2022 23:06:36 GMT
Group-4@2x.png
redcursor.com.au/wp-content/uploads/2021/06/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/06/Group-4@2x.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3aac3bf8e968187e8c7bb7fde5a71cf7085416179b44453899bbb557c643dc0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Thu, 17 Jun 2021 06:16:47 GMT
server
cloudflare
etag
"60cae8cf-bbc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29877ad39ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3004
Group-111@2x.png
redcursor.com.au/wp-content/uploads/2021/06/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/06/Group-111@2x.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
20f5359093f264ab31830dd251022c5cb95832ba6b82bbff77e46a4b1436d249

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
cf-cache-status
MISS
last-modified
Mon, 21 Jun 2021 04:33:48 GMT
server
cloudflare
etag
"60d016ac-b61"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29877ad49ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2913
web-by_white.png
redcursor.com.au/wp-content/uploads/2022/04/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2022/04/web-by_white.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f613ae587818a719e572279976eb3448d818c7acfd0edfe61d6f44c98851614

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
cf-cache-status
MISS
last-modified
Fri, 01 Apr 2022 02:41:36 GMT
server
cloudflare
etag
"62466660-9b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29877ad79ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2480
regenerator-runtime.min.js
redcursor.com.au/wp-includes/js/dist/vendor/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 15 Nov 2021 16:35:13 GMT
server
cloudflare
etag
W/"61928c41-195e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a298719ea9ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
wp-polyfill.min.js
redcursor.com.au/wp-includes/js/dist/vendor/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 15 Nov 2021 12:50:17 GMT
server
cloudflare
etag
W/"61925789-4b3d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29876aa39ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
index.js
redcursor.com.au/wp-content/plugins/contact-form-7/includes/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.6.1
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 May 2022 19:13:43 GMT
server
cloudflare
etag
W/"62854567-25f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ac59ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
aos.js
redcursor.com.au/wp-content/themes/traff1k/assets/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/assets/js/aos.js
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
07bf48e29a128c215e845d08bbdfe88e32d27c61d62fbc2e15e635ec9c888362

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 17 Jun 2021 23:04:33 GMT
server
cloudflare
etag
W/"60cbd501-37da"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ac99ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
primary-navigation.js
redcursor.com.au/wp-content/themes/twentytwentyone/assets/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/twentytwentyone/assets/js/primary-navigation.js?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
896a30041e1249377848e9351f2fa7b064c64bcb75cb1bbcac7230284d9f1a9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 03 Aug 2021 02:55:38 GMT
server
cloudflare
etag
W/"6108b02a-1782"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877acb9ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
custom.js
redcursor.com.au/wp-content/themes/traff1k/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/assets/js/custom.js
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca5ade1c5d84cb7ba10bd5f2ad710302dc7bae5477ee7c88ff5c58a242ac7311

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 01 Jul 2021 06:02:12 GMT
server
cloudflare
etag
W/"60dd5a64-111b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ad09ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
responsive-embeds.js
redcursor.com.au/wp-content/themes/twentytwentyone/assets/js/ 		1 KB
793 B 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/twentytwentyone/assets/js/responsive-embeds.js?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c84b9432dad75b6cce98abcd62eecccc82cf4e293e92f80678d8d50bd1060cfe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 03 Aug 2021 02:55:38 GMT
server
cloudflare
etag
W/"6108b02a-467"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ad19ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
aos.js
redcursor.com.au/wp-content/plugins/cvw-pb-animation/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/plugins/cvw-pb-animation/aos.js?ver=5.9.3
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
acad8b7cc5185f7f00d6a71714f06ea3547e2f1dd6aaac91fe5a548ba8fc856f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 11 Apr 2022 21:22:47 GMT
server
cloudflare
etag
W/"62549c27-37e1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ad29ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
print.css
redcursor.com.au/wp-content/themes/twentytwentyone/assets/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/twentytwentyone/assets/css/print.css?ver=1.0.0
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3467f3eee5c95a86bb4992918b1368458185bf349949f862e6e3c5954fcd69f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 03 Aug 2021 02:55:38 GMT
server
cloudflare
etag
W/"6108b02a-b51"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
711a29877ad89ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css2
fonts.googleapis.com/ 		2 KB
933 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Oxygen:wght@300;400;700&display=swap
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/wp-content/themes/traff1k/compiled.css?ver=5.9.3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c646d5f3e7195c6cea187e909bb9b10ef75935f90f6be2b73a1f9546b814afb8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 26 May 2022 21:49:18 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 26 May 2022 23:06:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 26 May 2022 23:06:35 GMT
2sDfZG1Wl4LcnbuKjk0m.woff2
fonts.gstatic.com/s/oxygen/v15/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKjk0m.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Oxygen:wght@300;400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4014:80b::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e64f128d5352d04ea5c87031e4cf1ad204b72a0afb003ece52eeb997d28a570
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://redcursor.com.au
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 24 May 2022 05:08:33 GMT
x-content-type-options
nosniff
age
237483
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16348
x-xss-protection
0
last-modified
Mon, 09 May 2022 18:31:32 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 24 May 2023 05:08:33 GMT
fa-solid-900.woff2
redcursor.com.au/wp-content/themes/traff1k/assets/webfonts/ 		76 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/assets/webfonts/fa-solid-900.woff2
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/wp-content/themes/traff1k/assets/css/all.css?ver=5.9.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef

Request headers

Referer
https://redcursor.com.au/wp-content/themes/traff1k/assets/css/all.css?ver=5.9.3
Origin
https://redcursor.com.au
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
cf-cache-status
MISS
last-modified
Thu, 24 Jun 2021 00:59:07 GMT
server
cloudflare
etag
"60d3d8db-13174"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29878adf9ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
78196
2020-06-26-15-03-57_orig.png
redcursor.com.au/wp-content/uploads/2021/08/ 		57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/08/2020-06-26-15-03-57_orig.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27a49a29f31e6758061cdbcb260dd21669478e4dbd8a053b24654e9be811f01f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Mon, 02 Aug 2021 03:03:01 GMT
server
cloudflare
etag
"61076065-e38f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29879b0c9ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58255
blocked-1_orig.png
redcursor.com.au/wp-content/uploads/2021/05/ 		284 KB
284 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/05/blocked-1_orig.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b932839993d10460460f940b67fbc3fd5c9678cbccaca2d2e39074e977a3cdcc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Wed, 23 Jun 2021 04:22:02 GMT
server
cloudflare
etag
"60d2b6ea-46ea5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29879b119ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
290469
code_orig.png
redcursor.com.au/wp-content/uploads/2021/06/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/06/code_orig.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a389f430163dce0f82cc60aec8be154c706f2bef72a44476813584ebfc9e195d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
cf-cache-status
MISS
last-modified
Wed, 23 Jun 2021 04:31:42 GMT
server
cloudflare
etag
"60d2b92e-19832"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29879b149ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
104498
using-zeek-to-detect-exploitation-of-citrix-cve-2019-19781.png
redcursor.com.au/wp-content/uploads/2021/06/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/06/using-zeek-to-detect-exploitation-of-citrix-cve-2019-19781.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4fb1ae5074cd2f3d051625061dfe6b35931437e4aa9e4696ace1375bb962a87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Wed, 23 Jun 2021 04:43:16 GMT
server
cloudflare
etag
"60d2bbe4-369d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a29879b159ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13981
fa-brands-400.woff2
redcursor.com.au/wp-content/themes/traff1k/assets/webfonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://redcursor.com.au/wp-content/themes/traff1k/assets/webfonts/fa-brands-400.woff2
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/wp-content/themes/traff1k/assets/css/all.css?ver=5.9.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af

Request headers

Referer
https://redcursor.com.au/wp-content/themes/traff1k/assets/css/all.css?ver=5.9.3
Origin
https://redcursor.com.au
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Thu, 24 Jun 2021 00:59:07 GMT
server
cloudflare
etag
"60d3d8db-12bdc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a2987ab179ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
76764
2sDcZG1Wl4LcnbuCNWgzaGW5.woff2
fonts.gstatic.com/s/oxygen/v15/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/oxygen/v15/2sDcZG1Wl4LcnbuCNWgzaGW5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Oxygen:wght@300;400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4014:80b::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5740bce57f68562d42e8ca6f6eb70dca3bc33be11ef0361e78274d360f41adc9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://redcursor.com.au
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 23 May 2022 22:30:45 GMT
x-content-type-options
nosniff
age
261351
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16172
x-xss-protection
0
last-modified
Mon, 09 May 2022 18:30:51 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 May 2023 22:30:45 GMT
2020-06-26-15-03-57_orig-768x268.png
redcursor.com.au/wp-content/uploads/2020/07/ 		97 KB
98 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2020/07/2020-06-26-15-03-57_orig-768x268.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
caf0e18d0efb8c356e928e0618ce5b1e5dd6b699a42b422901795189f8427383

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:36 GMT
cf-cache-status
MISS
last-modified
Mon, 30 Aug 2021 06:03:01 GMT
server
cloudflare
etag
"612c7495-1854c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a2987cb6d9ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
99660
2020-06-26-16-06-09_orig-pic2-768x503.png
redcursor.com.au/wp-content/uploads/2020/07/ 		149 KB
149 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2020/07/2020-06-26-16-06-09_orig-pic2-768x503.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cc8d61562040b1f692a741458e56c938e2d08cdfac8e90a69d5dfd4a7f56125

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Mon, 30 Aug 2021 06:02:58 GMT
server
cloudflare
etag
"612c7492-253ab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a2987cb719ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
152491
nasty-loader_orig-pic3-768x560.png
redcursor.com.au/wp-content/uploads/2020/07/ 		155 KB
156 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2020/07/nasty-loader_orig-pic3-768x560.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
25854d4fbb105d283c4020f2819a184e0666dfe752cc59c54b301287d4b06628

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Mon, 30 Aug 2021 06:02:55 GMT
server
cloudflare
etag
"612c748f-26d29"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a2987cb739ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
159017
Red-Cursor-logo.png
redcursor.com.au/wp-content/uploads/2021/06/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://redcursor.com.au/wp-content/uploads/2021/06/Red-Cursor-logo.png
Requested by
Host: redcursor.com.au
URL: https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e4a31cc718aa38063672696cd6ccb94889c9b3be83952cf0f386fadb070db2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/bypassing-crowdstrike-endpoint-detection-and-response/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 23:06:37 GMT
cf-cache-status
MISS
last-modified
Thu, 24 Jun 2021 04:26:47 GMT
server
cloudflare
etag
"60d40987-18fd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
711a2987cb759ba6-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6397
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-119466155-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcursor.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
2848
date
Thu, 26 May 2022 22:19:08 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Fri, 27 May 2022 00:19:08 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1165612209&t=pageview&_s=1&dl=https%3A%2F%2Fredcursor.com.au%2Fbypassing-crowdstrike-endpoint-detection-and-response%2F&ul=en-us&de=UTF-8&dt=Bypassing%20CrowdStrike%20Endpoint%20Detection%20and%20Response%20-%20Red%20Cursor&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1714402588&gjid=729696016&cid=985772208.1653606396&tid=UA-119466155-1&_gid=656456292.1653606396&_r=1&gtm=2ou5p1&z=317800065
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redcursor.com.au/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 26 May 2022 23:06:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcursor.com.au
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation undefined| $ function| jQuery object| sibErrMsg object| ajax_sib_front_object string| captchaRes function| sibVerifyCallback function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData object| runtime object| regeneratorRuntime function| setImmediate function| clearImmediate object| wpcf7 object| AOS function| twentytwentyoneToggleAriaExpanded function| twentytwentyoneCollapseMenuOnClickOutside function| twentytwentyoneSubmenuPosition function| twentytwentyoneExpandSubMenu function| animatedScrollToObject function| twentytwentyoneResponsiveEmbeds number| viewport number| scrollwindow object| element

3 Cookies

Domain/Path Name / Value
.redcursor.com.au/ Name: _ga
Value: GA1.3.985772208.1653606396
.redcursor.com.au/ Name: _gid
Value: GA1.3.656456292.1653606396
.redcursor.com.au/ Name: _gat_gtag_UA_119466155_1
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
redcursor.com.au
www.google-analytics.com
www.googletagmanager.com
141.193.213.20
2a00:1450:4001:811::200a
2a00:1450:4001:828::200e
2a00:1450:4001:831::2008
2a00:1450:4014:80b::2003
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
07bf48e29a128c215e845d08bbdfe88e32d27c61d62fbc2e15e635ec9c888362
0a6eebc36e4a57718c790fe3f3068cf8a6c1d7c1280e7c69bbf8d19939a5f632
0cc8d61562040b1f692a741458e56c938e2d08cdfac8e90a69d5dfd4a7f56125
20f5359093f264ab31830dd251022c5cb95832ba6b82bbff77e46a4b1436d249
25854d4fbb105d283c4020f2819a184e0666dfe752cc59c54b301287d4b06628
27a49a29f31e6758061cdbcb260dd21669478e4dbd8a053b24654e9be811f01f
3467f3eee5c95a86bb4992918b1368458185bf349949f862e6e3c5954fcd69f9
3c288f0c3cb0999bbd6a9f6486f6b13064ead24052234ac35f8b053b9db9ae96
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
547dda3c14b284819be511be1e410da94a5efc6ccc4a9afe1c75394f9333191a
5740bce57f68562d42e8ca6f6eb70dca3bc33be11ef0361e78274d360f41adc9
57a50c99a31ef4e89e86664e96f6dfbdde163a2eb96e88b3b492c49aa4be2f37
58af6e63322e8e4a9fc700b7f56c3052e269ca5d5ab164513870d7b4950e1131
679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e4a31cc718aa38063672696cd6ccb94889c9b3be83952cf0f386fadb070db2b
896a30041e1249377848e9351f2fa7b064c64bcb75cb1bbcac7230284d9f1a9f
911c68ef3d2106a0b2295297caf1813e616ca53e9c7bf6bb8f003371f5c1ed5b
9e64f128d5352d04ea5c87031e4cf1ad204b72a0afb003ece52eeb997d28a570
9f613ae587818a719e572279976eb3448d818c7acfd0edfe61d6f44c98851614
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a28fcee44d2b8c2706855b35e5b9b9e49008514aa65163615d710a097f94c63e
a389f430163dce0f82cc60aec8be154c706f2bef72a44476813584ebfc9e195d
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a42385cb75bd932299bc874f54a779a447fd688a6ff74be2d7f96c26779b6a5b
acad8b7cc5185f7f00d6a71714f06ea3547e2f1dd6aaac91fe5a548ba8fc856f
b932839993d10460460f940b67fbc3fd5c9678cbccaca2d2e39074e977a3cdcc
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c4fb1ae5074cd2f3d051625061dfe6b35931437e4aa9e4696ace1375bb962a87
c646d5f3e7195c6cea187e909bb9b10ef75935f90f6be2b73a1f9546b814afb8
c84b9432dad75b6cce98abcd62eecccc82cf4e293e92f80678d8d50bd1060cfe
ca5ade1c5d84cb7ba10bd5f2ad710302dc7bae5477ee7c88ff5c58a242ac7311
caf0e18d0efb8c356e928e0618ce5b1e5dd6b699a42b422901795189f8427383
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d8469ad6e03ba1a6c2c9fee151001c818233baff45efada0b93f6d864c21dbb3
dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e3aac3bf8e968187e8c7bb7fde5a71cf7085416179b44453899bbb557c643dc0
e405a026e7ce6e9e32733088d95c529ada4596ae3ba80c19fce9bcbfd0fb43ae
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e5ad31a47913cdfc2470acd4e304982fae2bccf62098855fecf3b84c1e7fea34