www.harmj0y.net Open in urlscan Pro
104.145.225.3 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Submission: On November 04 via manual (November 4th 2019, 5:49:53 pm UTC) from US

Summary HTTP 70 Redirects Links 29 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 10 domains to perform 70 HTTP transactions. The main IP is 104.145.225.3, located in Piscataway, United States and belongs to AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US. The main domain is www.harmj0y.net.

This is the only time www.harmj0y.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	104.145.225.3 104.145.225.3	64245 (AS-DIGITA...) (AS-DIGITALFYRE - DigitalFyre Internet Solutions)
1	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
3	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
7	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1 2	192.30.253.119 192.30.253.119	36459 (GITHUB) (GITHUB - GitHub)
15	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1 2	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER - Twitter Inc.)
1	185.199.108.154 185.199.108.154	54113 (FASTLY) (FASTLY - Fastly)
1	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
70	13

31 104.145.225.3 (Piscataway, United States)

ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US)
PTR: pandora.digitaldatacenter.net

www.harmj0y.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.30.253.119 (United States) 1 redirects

ASN36459 (GITHUB - GitHub, Inc., US)
PTR: lb-192-30-253-119-iad.github.com

gist.github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
abs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ton.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.8 (United States) 1 redirects

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.108.154 (Hoover, United States)

ASN54113 (FASTLY - Fastly, US)

github.githubassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	harmj0y.net www.harmj0y.net	707 KB
15	twimg.com cdn.syndication.twimg.com abs.twimg.com pbs.twimg.com ton.twimg.com	200 KB
9	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	109 KB
6	gravatar.com 1.gravatar.com 0.gravatar.com secure.gravatar.com	18 KB
3	gstatic.com fonts.gstatic.com	28 KB
3	wp.com s0.wp.com stats.wp.com pixel.wp.com	7 KB
2	github.com 1 redirects gist.github.com	5 KB
1	w.org s.w.org	568 B
1	githubassets.com github.githubassets.com	5 KB
1	googleapis.com fonts.googleapis.com	1 KB
70	10

	Domain	Requested by
31	www.harmj0y.net	www.harmj0y.net
10	pbs.twimg.com	www.harmj0y.net
7	platform.twitter.com	www.harmj0y.net platform.twitter.com
3	fonts.gstatic.com	www.harmj0y.net
3	secure.gravatar.com	www.harmj0y.net
2	ton.twimg.com	platform.twitter.com
2	abs.twimg.com	www.harmj0y.net platform.twitter.com
2	syndication.twitter.com	1 redirects www.harmj0y.net
2	gist.github.com	1 redirects www.harmj0y.net
2	1.gravatar.com	www.harmj0y.net
1	s.w.org	www.harmj0y.net
1	github.githubassets.com	www.harmj0y.net
1	cdn.syndication.twimg.com	platform.twitter.com
1	pixel.wp.com	www.harmj0y.net
1	stats.wp.com	www.harmj0y.net
1	s0.wp.com	www.harmj0y.net
1	0.gravatar.com	www.harmj0y.net
1	fonts.googleapis.com	www.harmj0y.net
70	18

This site contains links to these domains. Also see Links.

Domain
twitter.com
github.com
bloodhoundgang.herokuapp.com
specterops.io
bluescreenofjeff.com
enigma0x3.net
www.invoke-ir.com
wald0.com
www.irongeek.com
blog.cobaltstrike.com
www.slideshare.net
gist.github.com
sixdub.net
www.yworks.com
msdn.microsoft.com
technet.microsoft.com
clymb3r.wordpress.com
cyberoperations.wordpress.com
akismet.com
www.competethemes.com

Subject Issuer	Validity	Valid
*.wp.com Go Daddy Secure Certificate Authority - G2	`2018-04-10` - `2020-05-11`	2 years	crt.sh
*.gravatar.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.github.com DigiCert SHA2 High Assurance Server CA	`2019-07-08` - `2020-07-16`	a year	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2018-11-19` - `2019-11-27`	a year	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.githubassets.com DigiCert SHA2 High Assurance Server CA	`2018-10-29` - `2020-11-02`	2 years	crt.sh
*.w.org Go Daddy Secure Certificate Authority - G2	`2016-11-29` - `2019-12-29`	3 years	crt.sh

This page contains 4 frames:

Primary Page: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Frame ID: E1D479CB873ED86E533D05052ADC7160
Requests: 54 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html?origin=http%3A%2F%2Fwww.harmj0y.net
Frame ID: 3FEFD36A0B74D7FE03924DB67FC6832D
Requests: 1 HTTP requests in this frame

Frame: https://abs.twimg.com/emoji/v2/72x72/1f447.png
Frame ID: 4C08DC11F970469D7772563B0D6E51F4
Requests: 19 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: A46AF5EF6B6201599126B114C24B8ACD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

70
Requests

40 %
HTTPS

42 %
IPv6

10
Domains

18
Subdomains

13
IPs

3
Countries

1079 kB
Transfer

1685 kB
Size

0
Cookies

29 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/harmj0y
Title: twitter

Search URL Search Domain Scan URL

URL: https://github.com/harmj0y
Title: github

Search URL Search Domain Scan URL

URL: https://bloodhoundgang.herokuapp.com/
Title: slack

Search URL Search Domain Scan URL

URL: https://specterops.io/

Search URL Search Domain Scan URL

URL: https://bluescreenofjeff.com/
Title: bluescreenofjeff.com

Search URL Search Domain Scan URL

URL: https://enigma0x3.net/
Title: enigma0x3.net

Search URL Search Domain Scan URL

URL: http://www.invoke-ir.com/
Title: invoke-ir.com

Search URL Search Domain Scan URL

URL: https://wald0.com/
Title: wald0.com

Search URL Search Domain Scan URL

URL: http://www.irongeek.com/i.php?page=videos/derbycon4/t105-abusing-active-directory-in-post-exploitation-carlos-perez
Title: Carlos Perez’s talk at Derbycon ’14

Search URL Search Domain Scan URL

URL: https://github.com/Veil-Framework/PowerTools/tree/master/PowerView
Title: PowerView

Search URL Search Domain Scan URL

URL: http://blog.cobaltstrike.com/2012/12/05/offense-in-depth/
Title: offensive-in-depth

Search URL Search Domain Scan URL

URL: http://www.slideshare.net/harmj0y/derbycon-passing-the-torch
Title: Passing the Torch: Old School Redteaming, New School Tactics?

Search URL Search Domain Scan URL

URL: https://gist.github.com/HarmJ0y/17da95932073e0c30928/raw/bb22c01e903a7c956c69344edbabf2f84c2b7ce9/trusts.csv
Title: view raw

Search URL Search Domain Scan URL

URL: https://gist.github.com/HarmJ0y/17da95932073e0c30928#file-trusts-csv
Title: trusts.csv

Search URL Search Domain Scan URL

URL: https://github.com/
Title: GitHub

Search URL Search Domain Scan URL

URL: https://twitter.com/sixdub
Title: @sixdub

Search URL Search Domain Scan URL

URL: https://github.com/sixdub/DomainTrustExplorer
Title: DomainTrustExplorer

Search URL Search Domain Scan URL

URL: http://sixdub.net/2014/10/nodal-analysis-of-domain-trusts-maximizing-the-win/
Title: Nodal Analysis of Domain Trusts – Maximizing the Win!

Search URL Search Domain Scan URL

URL: http://www.yworks.com/en/products/yfiles/yed/
Title: in yED

Search URL Search Domain Scan URL

URL: http://msdn.microsoft.com/en-us/library/system.directoryservices.activedirectory.trusttype(v=vs.110).aspx
Title: are crosslinks

Search URL Search Domain Scan URL

URL: http://technet.microsoft.com/en-us/library/cc756898(WS.10).aspx
Title: enterprise admin account

Search URL Search Domain Scan URL

URL: https://clymb3r.wordpress.com/2013/11/17/injecting-logon-credentials-with-powershell/
Title: PowerSploit

Search URL Search Domain Scan URL

URL: https://github.com/mattifestation/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1
Title: PowerSploit’s Invoke-NinjaCopy

Search URL Search Domain Scan URL

URL: http://blog.cobaltstrike.com/2014/05/14/meterpreter-kiwi-extension-golden-ticket-howto/
Title: golden ticket

Search URL Search Domain Scan URL

URL: https://github.com/mattifestation/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1
Title: PowerSploit’s Invoke-Mimikatz

Search URL Search Domain Scan URL

URL: http://blog.cobaltstrike.com/2014/10/30/give-me-any-zero-day-and-i-will-rule-the-world/
Title: didn’t use a single exploit

Search URL Search Domain Scan URL

URL: https://cyberoperations.wordpress.com/2015/03/07/security-news-0x83/
Title: Security News #0x83 | CyberOperations

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://www.competethemes.com/cele/
Title: Cele Theme

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

https://gist.github.com/17da95932073e0c30928.json?callback=jQuery11240267005807306121_1572889777518&_=1572889777519 HTTP 302
https://gist.github.com/HarmJ0y/17da95932073e0c30928.json?_=1572889777519&callback=jQuery11240267005807306121_1572889777518

Request Chain 73

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

70 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/ 87 KB
18 KB 216ms
175ms Document
text/html 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL

http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Server

104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),

Reverse DNS

pandora.digitaldatacenter.net

Software

LiteSpeed / PHP/7.0.33

Resource Hash

3d0c5826279971852705472c76a62b0f1b166fb6495921c42e890d07bbae046a

Security Headers

Name	Value
X-Content-Type-Options	nosniff,nosniff

Request headers

Host: www.harmj0y.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

X-Powered-By: PHP/7.0.33
Content-Type: text/html; charset=UTF-8
X-Pingback: http://www.harmj0y.net/blog/xmlrpc.php
Link: <http://www.harmj0y.net/blog/wp-json/>; rel="https://api.w.org/" <https://wp.me/p4qDDn-cB>; rel=shortlink
Etag: "273450-1572870293;gz"
X-LiteSpeed-Cache: hit
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 17814
Date: Mon, 04 Nov 2019 17:49:35 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Pragma: public
Cache-Control: public, must-revalidate, proxy-revalidate,public, must-revalidate, proxy-revalidate
X-Content-Type-Options: nosniff,nosniff
Connection: close

GET
H/1.1 200
OK crayon.min.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
4 KB 193ms
178ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
ETag: "4ecc-57328dd4-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3959
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK classic.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/themes/classic/ 4 KB
1 KB 193ms
179ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
ETag: "1110-57328dd4-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 727
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK monaco.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/ 529 B
679 B 190ms
175ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
ETag: "211-57328dd4-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 240
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK style.min.css
www.harmj0y.net/blog/wp-includes/css/dist/block-library/ 25 KB
5 KB 193ms
178ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Feb 2019 01:26:05 GMT
Server: LiteSpeed
ETag: "629a-5c7738ad-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4258
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 7 KB
1 KB 23ms
15ms Stylesheet
text/css 2a00:1450:4001:824::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

44a2bf681f7bc4a15e5881959e21718c04532eacb5f012d0d70284bb4f7d4d0f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Nov 2019 17:49:37 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Mon, 04 Nov 2019 17:49:37 GMT

GET
H/1.1 200
OK font-awesome.min.css
www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/ 30 KB
7 KB 184ms
170ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/font-awesome.min.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 14 May 2017 23:35:39 GMT
Server: LiteSpeed
ETag: "7918-5918e9cb-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7050
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK style.css
www.harmj0y.net/blog/wp-content/themes/cele/ 34 KB
7 KB 257ms
169ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/themes/cele/style.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: dce60247f8fe8382f96de643513d7d0e06af9178c362779050f9e0af90644c2e

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 14 May 2017 23:35:39 GMT
Server: LiteSpeed
ETag: "884e-5918e9cb-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7181
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK default.min.css
www.harmj0y.net/blog/wp-content/plugins/tablepress/css/ 6 KB
3 KB 277ms
92ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/tablepress/css/default.min.css?ver=1.9.2
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Feb 2019 08:04:25 GMT
Server: LiteSpeed
ETag: "16ef-5c70fe89-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2732
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK jetpack.css
www.harmj0y.net/blog/wp-content/plugins/jetpack/css/ 70 KB
13 KB 284ms
94ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/jetpack/css/jetpack.css?ver=7.8
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 01:02:56 GMT
Server: LiteSpeed
ETag: "117db-5d93f740-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 12563
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK jquery.js Show response
www.harmj0y.net/blog/wp-includes/js/jquery/ 95 KB
33 KB 289ms
96ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 05 Sep 2019 11:04:55 GMT
Server: LiteSpeed
ETag: "17a69-5d70ebd7-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 33804
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK jquery-migrate.min.js Show response
www.harmj0y.net/blog/wp-includes/js/jquery/ 10 KB
4 KB 290ms
96ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2016 06:11:28 GMT
Server: LiteSpeed
ETag: "2748-573eaa90-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4014
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK crayon.min.js Show response
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
7 KB 290ms
97ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
ETag: "5741-57328dd4-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6790
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK specterops.png
www.harmj0y.net/blog/wp-content/uploads/2017/07/ 69 KB
64 KB 92ms
91ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2017/07/specterops.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: cff92a7eb12d555a40c2c94c90f8b23009c1a7298e15b47d6f7ae6b744fdac15

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Jul 2017 04:49:36 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 65705
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK trustexporer_graphml_dump-1024x156.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 73 KB
70 KB 91ms
91ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/trustexporer_graphml_dump-1024x156.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 6e2061db4fd58afb4dd366ae2988505313a289c803e1ea3c72fe8599efa40aa1

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:32:16 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 71080
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK yed_node_config-1024x420.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 78 KB
72 KB 91ms
91ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/yed_node_config-1024x420.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: a35aae89abeaad7bc82884a8f7a81050a75fb88512989bbe7bbb0413b08ddae6

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:42:15 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 73402
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK yed_edge_config-1024x419.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 78 KB
73 KB 91ms
91ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/yed_edge_config-1024x419.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: a9609578d22eb71f002d3f184a6841bb5a4bfe964e4e2e1c51733ea53b7c5812

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:42:25 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 74023
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK sample_trusts.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 13 KB
12 KB 96ms
95ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/sample_trusts.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: a8cfafcd5e63088eedf5a8e2ee90f7d6330fc072f63a4b515270e7fa377321b6

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:42:42 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 12094
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK trust_breakout-1024x411.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 69 KB
67 KB 96ms
95ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/trust_breakout-1024x411.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: d592fa9c8989da648bc537f44ba55b7e60b6eb88557eaef9c2ddcb4eea74a906

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:46:47 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 68355
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK subsidiary_trusts.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 8 KB
8 KB 95ms
94ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/subsidiary_trusts.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 1559aa8c42629bff9ebfb2d5c4083b9bde3b8d9d6a95c05ffe1e64832ee0dda6

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 06:48:40 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7478
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK trustexplorer_path-1024x238.png
www.harmj0y.net/blog/wp-content/uploads/2014/12/ 133 KB
125 KB 91ms
91ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/uploads/2014/12/trustexplorer_path-1024x238.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 9e7e71334eddfdc7344ba4ac18721dc98012faa2093f17c4142d0f150717654b

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 Dec 2014 07:08:02 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 127714
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 12 KB
5 KB 98ms
97ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Feb 2019 01:26:05 GMT
Server: LiteSpeed
ETag: "2f02-5c7738ad-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 4388
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK /
1.gravatar.com/avatar/ 1021 B
1 KB 25ms
12ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://1.gravatar.com/avatar/?s=48&d=mm&r=g
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 37a3bd7bc7328f0ead2c0f6f635dddf60615e676e6b4ddf964144012e529de45

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

X-nc: HIT vie 1
Date: Mon, 04 Nov 2019 17:49:37 GMT
Last-Modified: Wed, 11 Jan 1984 08:00:00 GMT
Server: nginx
Source-Age: 11124774
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Content-Disposition: inline; filename="none.png"
Connection: keep-alive
Accept-Ranges: bytes
Link: <https://www.gravatar.com/avatar/?s=48&d=mm&r=g>; rel="canonical"
Content-Length: 1021
Expires: Mon, 04 Nov 2019 17:54:37 GMT

GET
H/1.1 200
OK 3eda6fcd3204ef285fa52176c28c4d3e
0.gravatar.com/avatar/ 1021 B
2 KB 26ms
12ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://0.gravatar.com/avatar/3eda6fcd3204ef285fa52176c28c4d3e?s=48&d=mm&r=g
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e3e6358df951436d7c4e597f61f7bb0dcbfa9b99385c14a7016bd5475cd7d07

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

X-nc: HIT vie 3
Date: Mon, 04 Nov 2019 17:49:37 GMT
Last-Modified: Wed, 11 Jan 1984 08:00:00 GMT
Server: nginx
Source-Age: 11119371
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Content-Disposition: inline; filename="3eda6fcd3204ef285fa52176c28c4d3e.png"
Connection: keep-alive
Accept-Ranges: bytes
Link: <https://www.gravatar.com/avatar/3eda6fcd3204ef285fa52176c28c4d3e?s=48&d=mm&r=g>; rel="canonical"
Content-Length: 1021
Expires: Mon, 04 Nov 2019 17:54:37 GMT

GET
H/1.1 200
OK a874809641a854ae50e959b608dadefc
1.gravatar.com/avatar/ 5 KB
5 KB 25ms
12ms Image
image/png 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://1.gravatar.com/avatar/a874809641a854ae50e959b608dadefc?s=48&d=mm&r=g
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 525d0c63376a81b2e0e6414f51f3d9911f339545bc2288d2f0b5a1afe0a0b3cc

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

X-nc: HIT vie 3
Date: Mon, 04 Nov 2019 17:49:37 GMT
Last-Modified: Mon, 30 Jun 2014 14:51:01 GMT
Server: nginx
Source-Age: 10968846
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Content-Disposition: inline; filename="a874809641a854ae50e959b608dadefc.png"
Connection: keep-alive
Accept-Ranges: bytes
Link: <https://www.gravatar.com/avatar/a874809641a854ae50e959b608dadefc?s=48&d=mm&r=g>; rel="canonical"
Content-Length: 4949
Expires: Mon, 04 Nov 2019 17:54:37 GMT

GET
H2 200 devicepx-jetpack.js Show response
s0.wp.com/wp-content/js/ 10 KB
3 KB 48ms
15ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201945
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
server: nginx
etag: W/"5867460b-52b6"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 2.ams _dfw
expires: Mon, 02 Nov 2020 14:02:12 GMT

GET
H2 200 gprofiles.js Show response
secure.gravatar.com/js/ 20 KB
7 KB 14ms
12ms Script
application/x-javascript 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/js/gprofiles.js?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
last-modified: Thu, 23 Aug 2018 15:01:14 GMT
server: nginx
etag: W/"5b7ecc3a-50bc"
content-type: application/x-javascript
status: 200
cache-control: max-age=604800
expires: Mon, 11 Nov 2019 17:49:37 GMT

GET
H/1.1 200
OK wpgroho.js Show response
www.harmj0y.net/blog/wp-content/plugins/jetpack/modules/ 1 KB
949 B 100ms
98ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/jetpack/modules/wpgroho.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 01:02:56 GMT
Server: LiteSpeed
ETag: "42e-5d93f740-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 496
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK production.min.js Show response
www.harmj0y.net/blog/wp-content/themes/cele/js/build/ 6 KB
3 KB 101ms
99ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/themes/cele/js/build/production.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 703b134857241eccea000989b0435dde381988f53d40119744bff8d1cf828a63

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 14 May 2017 23:35:39 GMT
Server: LiteSpeed
ETag: "19c5-5918e9cb-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2297
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK comment-reply.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 2 KB
2 KB 100ms
99ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/js/comment-reply.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Mar 2019 03:05:26 GMT
Server: LiteSpeed
ETag: "8ba-5c887376-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1093
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK twitter-timeline.min.js Show response
www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/ 331 B
714 B 98ms
96ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 01:02:56 GMT
Server: LiteSpeed
ETag: "14b-5d93f740-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 261
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK wp-embed.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 1 KB
1 KB 97ms
96ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-includes/js/wp-embed.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Dec 2018 03:05:16 GMT
Server: LiteSpeed
ETag: "57b-5c11cc6c-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 753
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK gist.min.js Show response
www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/shortcodes/js/ 442 B
771 B 96ms
96ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/shortcodes/js/gist.min.js?ver=7.8
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 42044d2f67a563820783809582b367cf2195586acffb544fbc01d9c58787d435

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Oct 2019 01:02:56 GMT
Server: LiteSpeed
ETag: "1ba-5d93f740-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 318
Expires: Mon, 11 Nov 2019 17:49:35 GMT

GET
H/1.1 200
OK form.js Show response
www.harmj0y.net/blog/wp-content/plugins/akismet/_inc/ 700 B
771 B 96ms
95ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/akismet/_inc/form.js?ver=4.1.3
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Pragma: public
Date: Mon, 04 Nov 2019 17:49:36 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Nov 2019 07:02:34 GMT
Server: LiteSpeed
ETag: "2bc-5dbbd88a-0;gz"
Vary: Accept-Encoding,Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public, must-revalidate, proxy-revalidate
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 318
Expires: Mon, 11 Nov 2019 17:49:36 GMT

GET
H2 200 e-201945.js Show response
stats.wp.com/ 9 KB
3 KB 49ms
18ms Script
application/x-javascript 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-201945.js
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
expires: Mon, 02 Nov 2020 14:04:05 GMT

GET
H/1.1 200
OK buttons.png
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/ 2 KB
2 KB 96ms
95ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/buttons.png
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab

Request headers

Referer: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:36 GMT
Content-Encoding: gzip
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1931
Expires: Mon, 11 Nov 2019 17:49:36 GMT

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 13ms
7ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: http://www.harmj0y.net

Response headers

Date: Fri, 01 Nov 2019 19:09:42 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 19:30:37 GMT
Server: sffe
Age: 254395
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 9016
X-XSS-Protection: 0
Expires: Sat, 31 Oct 2020 19:09:42 GMT

GET
H/1.1 200
OK fontawesome-webfont.woff2
www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/fonts/ 75 KB
76 KB 181ms
96ms Font
font/woff2 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer: http://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/font-awesome.min.css?ver=5.1.3
Origin: http://www.harmj0y.net

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Last-Modified: Sun, 14 May 2017 23:35:39 GMT
Server: LiteSpeed
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 77160
Content-Type: font/woff2

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: http://www.harmj0y.net

Response headers

Date: Fri, 01 Nov 2019 13:59:32 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 19:30:44 GMT
Server: sffe
Age: 273005
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 9180
X-XSS-Protection: 0
Expires: Sat, 31 Oct 2020 13:59:32 GMT

GET
H/1.1 200
OK memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v17/ 10 KB
10 KB 12ms
7ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v17/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: http://www.harmj0y.net

Response headers

Date: Thu, 31 Oct 2019 14:10:19 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 23 Jul 2019 19:30:56 GMT
Server: sffe
Age: 358758
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 9744
X-XSS-Protection: 0
Expires: Fri, 30 Oct 2020 14:10:19 GMT

GET
H/1.1 200
OK monaco-webfont.woff
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/ 21 KB
21 KB 171ms
97ms Font
font/woff 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/monaco-webfont.woff
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Referer: http://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Origin: http://www.harmj0y.net

Response headers

Date: Mon, 04 Nov 2019 17:49:35 GMT
Last-Modified: Wed, 11 May 2016 01:41:40 GMT
Server: LiteSpeed
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 21372
Content-Type: font/woff

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 12ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.twitter.com/widgets.js
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Protocol: HTTP/1.1
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: f5b5ac5fdb8870504505be0a9522061f905e5c1b25a927f877303785129cb3f9

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:50:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 23:03:20 GMT
Server: ECS (fcn/4187)
Etag: "dbb5834a50c19a7a8e3ad3ae8f1c1329+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28705

GET
H/1.1 200
OK hovercard.min.css
secure.gravatar.com/dist/css/ 7 KB
2 KB 24ms
12ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: http://secure.gravatar.com/dist/css/hovercard.min.css?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Mar 2018 09:46:04 GMT
Server: nginx
ETag: W/"5ab37b5c-1a2e"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Mon, 11 Nov 2019 17:49:37 GMT

GET
H/1.1 200
OK services.min.css
secure.gravatar.com/dist/css/ 3 KB
847 B 24ms
12ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: http://secure.gravatar.com/dist/css/services.min.css?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol: HTTP/1.1
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Mar 2018 09:46:04 GMT
Server: nginx
ETag: W/"5ab37b5c-a54"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800
Connection: keep-alive
Expires: Mon, 11 Nov 2019 17:49:37 GMT

GET
H/1.1

200
OK

17da95932073e0c30928.json Show response
gist.github.com/HarmJ0y/
Redirect Chain

https://gist.github.com/17da95932073e0c30928.json?callback=jQuery11240267005807306121_1572889777518&_=1572889777519
https://gist.github.com/HarmJ0y/17da95932073e0c30928.json?_=1572889777519&callback=jQuery11240267005807306121_1572889777518

9 KB
3 KB

148ms
148ms

Script
application/javascript

192.30.253.119
GitHub

General

Check archive.org

Show headers Download Go to

Full URL

https://gist.github.com/HarmJ0y/17da95932073e0c30928.json?_=1572889777519&callback=jQuery11240267005807306121_1572889777518

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

192.30.253.119 , United States, ASN36459 (GITHUB - GitHub, Inc., US),

Reverse DNS

lb-192-30-253-119-iad.github.com

Software

GitHub.com /

Resource Hash

174de82d4093c663f085c9b3fd303c90431670538245c9c8d1d7c2947a21abd7

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.harmj0y.net/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Status: 200 OK
Vary: X-PJAX
X-XSS-Protection: 1; mode=block
X-Request-Id: a350d1de-094a-429f-9a24-d668d5f1bcf6
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: GitHub.com
X-GitHub-Request-Id: CF68:407E:2BB5DEC:4FC695D:5DC064B2
X-Frame-Options: deny
ETag: W/"174de82d4093c663f085c9b3fd303c90"
Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=0, private, must-revalidate
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com

Redirect headers

Date: Mon, 04 Nov 2019 17:49:38 GMT
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Status: 302 Found
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-XSS-Protection: 1; mode=block
X-Request-Id: c7d5603d-1e81-4ebc-9752-4e2878f69154
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Server: GitHub.com
X-GitHub-Request-Id: CF68:407E:2BB5DE3:4FC695A:5DC064B1
X-Frame-Options: deny
Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
Vary: X-PJAX
Content-Type: text/html; charset=utf-8
Location: https://gist.github.com/HarmJ0y/17da95932073e0c30928.json?_=1572889777519&callback=jQuery11240267005807306121_1572889777518
Cache-Control: no-cache
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com wss://live.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com

GET
H/1.1 200
OK widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html
platform.twitter.com/widgets/ Frame 3FEF 0
0 25ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d991e3dfc9abb2549972ce8b64c5d85.html?origin=http%3A%2F%2Fwww.harmj0y.net
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41AB) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Nov 2019 17:49:42 GMT
Etag: "7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified: Tue, 22 Oct 2019 22:27:25 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41AB)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5816

GET
H/1.1 200
OK g.gif
pixel.wp.com/ 50 B
215 B 31ms
17ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pixel.wp.com/g.gif?v=ext&j=1%3A7.8&blog=65454229&post=781&tz=-5&srv=www.harmj0y.net&host=www.harmj0y.net&ref=&fcp=668&rand=0.0023751155450364436
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
Protocol: HTTP/1.1
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Cache-Control: no-cache
Server: nginx
Connection: keep-alive
Content-Length: 50
Content-Type: image/gif

GET
H/1.1 200
OK moment~timeline~tweet.f41b02dcb58512d8e9f6d4178eb28452.js Show response
platform.twitter.com/js/ 24 KB
8 KB 6ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.f41b02dcb58512d8e9f6d4178eb28452.js
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E1) /
Resource Hash: 7c46604c0440be3fd2d6a5e217846cde699e81422afd52625b633bc28cfe3446

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:17 GMT
Server: ECS (fcn/40E1)
Etag: "acaa80339e9cea48739803700d80ebfb+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7914

GET
H/1.1 200
OK timeline.0a7b4db67eacd23e35c5ce02e6ea3470.js Show response
platform.twitter.com/js/ 23 KB
7 KB 13ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.0a7b4db67eacd23e35c5ce02e6ea3470.js
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/41A1) /
Resource Hash: f452b1e5c1cae40dc81a9da7605dd6b98d0a06253d9b363e11c99ec4081ace4c

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:49:37 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:17 GMT
Server: ECS (fcn/41A1)
Etag: "37399cf03250c85f4a77916c06810b4c+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7038

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 38 KB
6 KB 47ms
28ms Script
application/javascript 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_harmj0y_old&dnt=false&domain=www.harmj0y.net&lang=en&screen_name=harmj0y&suppress_response_codes=true&t=1747655&tweet_limit=5&tz=GMT%2B0100&with_replies=false

Requested by

Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (lcy/1D44) /

Resource Hash

7faf3e61494372b2d2c8e929e286f100306c7464521ad0c129741ac8e27d0017

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-disposition: attachment; filename=jsonp.jsonp
vary: Accept-Encoding
content-length: 5725
x-xss-protection: 0
x-response-time: 163
last-modified: Mon, 04 Nov 2019 17:47:50 GMT
server: ECS (lcy/1D44)
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=300
x-connection-hash: 8d53b469a93f27028c91d38b12f712d7
accept-ranges: bytes
timing-allow-origin: *
x-transaction: 00c054880012feb4
expires: Mon, 04 Nov 2019 17:54:37 GMT

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
337 B 169ms
144ms Image
image/gif 104.244.42.8
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1572889777811%2C%22dnt%22%3Afalse%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Mon, 04 Nov 2019 17:49:37 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 2959561ae8a93fddb03c30cdd9e1808a
x-transaction: 0021155f0000a02d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 1f447.png
abs.twimg.com/emoji/v2/72x72/ Frame 4C08 467 B
670 B 8ms
6ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/1f447.png

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40E7) /

Resource Hash

99a50b833fec96a9f274d707bb567cd242ec35db35d6bc26ac391c0619304b2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-ton-expected-size: 467
x-cache: HIT
status: 200
content-length: 467
x-response-time: 7
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:28:34 GMT
server: ECS (fcn/40E7)
etag: "BjsCV7rNDg+DxmKk6QZ/eA=="
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
x-connection-hash: 5269b57f5ee0ca8b87f135d5d2b1ba63
accept-ranges: bytes
expires: Tue, 03 Nov 2020 17:49:37 GMT

GET
H2 200 Vz8ZAq3r
pbs.twimg.com/card_img/1189543871757377537/ Frame 4C08 24 KB
24 KB 9ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1189543871757377537/Vz8ZAq3r?format=jpg&name=600x314

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A2) /

Resource Hash

7862c51c8ff9cee16f0cd466f1f1568b29a203e792f7f2f557b1c9a0092c52cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 24780
x-response-time: 155
surrogate-key: card_img card_img/bucket/6 card_img/1189543871757377537
last-modified: Wed, 30 Oct 2019 14:03:34 GMT
server: ECS (fcn/41A2)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 9ad36c4c30445b634bce0ddd6812a1f9
accept-ranges: bytes

GET
H2 200 AhXX8oEf
pbs.twimg.com/card_img/1188141775199842304/ Frame 4C08 31 KB
31 KB 14ms
11ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1188141775199842304/AhXX8oEf?format=png&name=144x144_2

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40B0) /

Resource Hash

47ec7a38cec39f5149eddbcb37386cdc2b75d801d46fee7e53edb5a6284b1543

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 31988
x-response-time: 136
surrogate-key: card_img card_img/bucket/3 card_img/1188141775199842304
last-modified: Sat, 26 Oct 2019 17:12:08 GMT
server: ECS (fcn/40B0)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: bef699af481f29b0f68af080737d1f3b
accept-ranges: bytes

GET
H/1.1 200
OK timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ Frame 4C08 52 KB
12 KB 6ms
6ms Stylesheet
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: 12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:50:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:13 GMT
Server: ECS (fcn/4187)
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H/1.1 200
OK timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ 52 KB
52 KB 10ms
10ms Image
text/css 2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Date: Mon, 04 Nov 2019 17:50:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Oct 2019 22:27:13 GMT
Server: ECS (fcn/4187)
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H2 200 1f447.png
abs.twimg.com/emoji/v2/72x72/ Frame 4C08 467 B
532 B 6ms
6ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/1f447.png

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline~tweet.f41b02dcb58512d8e9f6d4178eb28452.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40E7) /

Resource Hash

99a50b833fec96a9f274d707bb567cd242ec35db35d6bc26ac391c0619304b2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-ton-expected-size: 467
x-cache: HIT
status: 200
content-length: 467
x-response-time: 7
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:28:34 GMT
server: ECS (fcn/40E7)
etag: "BjsCV7rNDg+DxmKk6QZ/eA=="
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
x-connection-hash: 5269b57f5ee0ca8b87f135d5d2b1ba63
accept-ranges: bytes
expires: Tue, 03 Nov 2020 17:49:37 GMT

GET
H2 200 oq0KZS7N_normal.jpg
pbs.twimg.com/profile_images/996342484404985856/ Frame 4C08 2 KB
2 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/996342484404985856/oq0KZS7N_normal.jpg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4192) /

Resource Hash

ea602e3d9e87bcd7e368fdb7931ee6e21bf15d167c977f8922e095a7b4d8b462

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:27 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2263
x-response-time: 116
surrogate-key: profile_images profile_images/bucket/2 profile_images/996342484404985856
last-modified: Tue, 15 May 2018 10:50:14 GMT
server: ECS (fcn/4192)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: fd1594f7c1120463bd0cab6a4c4d9c9e
accept-ranges: bytes

GET
H2 200 dG9Y4RhK_normal.jpg
pbs.twimg.com/profile_images/883033419827032065/ Frame 4C08 2 KB
2 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/883033419827032065/dG9Y4RhK_normal.jpg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4193) /

Resource Hash

2192a8a11b3b0968c13f8933c5fdb91355f5584681429d76567cdbd4eda32fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:30 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2263
x-response-time: 203
surrogate-key: profile_images profile_images/bucket/8 profile_images/883033419827032065
last-modified: Thu, 06 Jul 2017 18:40:27 GMT
server: ECS (fcn/4193)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: b9682506e99271df821312ad3e0ca29f
accept-ranges: bytes

GET
H2 200 PuqwM2Ln_normal.jpg
pbs.twimg.com/profile_images/840223774423187456/ Frame 4C08 2 KB
2 KB 7ms
7ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/840223774423187456/PuqwM2Ln_normal.jpg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40D1) /

Resource Hash

6279717c85ec0510b97c6b9e4a8426c011a458e73f2f4e355c8ff1e75736873e

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:52 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2035
x-response-time: 115
surrogate-key: profile_images profile_images/bucket/1 profile_images/840223774423187456
last-modified: Fri, 10 Mar 2017 15:30:13 GMT
server: ECS (fcn/40D1)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: d235a0c93c377c982a47281bef75aae1
accept-ranges: bytes

GET
H2 200 Csp2-ofI_normal.jpg
pbs.twimg.com/profile_images/827908828574470144/ Frame 4C08 2 KB
2 KB 6ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/827908828574470144/Csp2-ofI_normal.jpg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40D8) /

Resource Hash

a8b16530224ab6db50c2ab417f171752a84d8f1fb5e241057ab94c4c4f4bd0c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:38 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2111
x-response-time: 118
surrogate-key: profile_images profile_images/bucket/2 profile_images/827908828574470144
last-modified: Sat, 04 Feb 2017 15:55:01 GMT
server: ECS (fcn/40D8)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 87712a7fbaea2d969084b3a50e4ef0fd
accept-ranges: bytes

GET
H2 200 33KXTXFs_normal.jpg
pbs.twimg.com/profile_images/1189278749856059392/ Frame 4C08 2 KB
2 KB 7ms
7ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1189278749856059392/33KXTXFs_normal.jpg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40B5) /

Resource Hash

643d4c503349a545d85578f353e05fd7bc2bd7576f3f22089e73cfb666131094

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:38 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2263
x-response-time: 114
surrogate-key: profile_images profile_images/bucket/5 profile_images/1189278749856059392
last-modified: Tue, 29 Oct 2019 20:30:04 GMT
server: ECS (fcn/40B5)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 098a3ebba103ffd6279078782f67fbde
accept-ranges: bytes

GET
H2 200 EHjpsv_WoAAYDZ6
pbs.twimg.com/media/ Frame 4C08 18 KB
19 KB 7ms
7ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EHjpsv_WoAAYDZ6?format=png&name=360x360

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40F9) /

Resource Hash

c53261c30acc3dbfd08bbe8baa920cc595fed119faec575a66cd100d85efa0a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:40 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 18839
x-response-time: 113
surrogate-key: media media/bucket/6 media/1186955456817831936
last-modified: Wed, 23 Oct 2019 10:38:08 GMT
server: ECS (fcn/40F9)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 7d874b1712d68003e5a2776038775b4e
accept-ranges: bytes

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame 4C08 44 KB
7 KB 7ms
6ms Stylesheet
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
vary: Accept-Encoding
content-length: 6839
x-response-time: 27
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
strict-transport-security: max-age=631138519
content-type: text/css
access-control-allow-origin: *
x-connection-hash: fe1906dbd72f3994c1b03d099f0b6dda
accept-ranges: bytes
expires: Mon, 11 Nov 2019 17:49:37 GMT

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ 44 KB
44 KB 10ms
9ms Image
text/css 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
vary: Accept-Encoding
content-length: 6839
x-response-time: 27
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
strict-transport-security: max-age=631138519
content-type: text/css
access-control-allow-origin: *
x-connection-hash: fe1906dbd72f3994c1b03d099f0b6dda
accept-ranges: bytes
expires: Mon, 11 Nov 2019 17:49:37 GMT

GET
DATA 200
OK truncated
/ Frame 4C08 512 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4C08 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4C08 739 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4C08 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 4C08 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 Vz8ZAq3r
pbs.twimg.com/card_img/1189543871757377537/ Frame 4C08 24 KB
24 KB 7ms
6ms Image
image/jpeg 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1189543871757377537/Vz8ZAq3r?format=jpg&name=600x314

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A2) /

Resource Hash

7862c51c8ff9cee16f0cd466f1f1568b29a203e792f7f2f557b1c9a0092c52cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 24780
x-response-time: 155
surrogate-key: card_img card_img/bucket/6 card_img/1189543871757377537
last-modified: Wed, 30 Oct 2019 14:03:34 GMT
server: ECS (fcn/41A2)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 9ad36c4c30445b634bce0ddd6812a1f9
accept-ranges: bytes

GET
H2 200 AhXX8oEf
pbs.twimg.com/card_img/1188141775199842304/ Frame 4C08 31 KB
31 KB 7ms
7ms Image
image/png 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1188141775199842304/AhXX8oEf?format=png&name=144x144_2

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40B0) /

Resource Hash

47ec7a38cec39f5149eddbcb37386cdc2b75d801d46fee7e53edb5a6284b1543

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date: Mon, 04 Nov 2019 17:49:37 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 31988
x-response-time: 136
surrogate-key: card_img card_img/bucket/3 card_img/1188141775199842304
last-modified: Sat, 26 Oct 2019 17:12:08 GMT
server: ECS (fcn/40B0)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: bef699af481f29b0f68af080737d1f3b
accept-ranges: bytes

GET
H2 200 gist-embed-123720f37c57ce9a8f29de081c38ed61.css
github.githubassets.com/assets/ 23 KB
5 KB 54ms
18ms Stylesheet
text/css 185.199.108.154
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://github.githubassets.com/assets/gist-embed-123720f37c57ce9a8f29de081c38ed61.css
Requested by: Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.199.108.154 Hoover, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dec22d665719520caba542fe8f59e42c4fb088143ff0e2d255374723ec2605a7

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-fastly-request-id: a06df3a54de757a6ff8233706d15e77043013b16
date: Mon, 04 Nov 2019 17:49:38 GMT
content-encoding: gzip
age: 1471481
x-cache: HIT, HIT
status: 200
access-control-max-age: 3600
content-length: 4971
via: 1.1 varnish, 1.1 varnish
x-served-by: cache-iad2143-IAD, cache-ams21047-AMS
last-modified: Fri, 18 Oct 2019 17:02:37 GMT
server: AmazonS3
x-timer: S1572889778.287714,VS0,VE0
etag: "41421896829ff4a69a1447f649f71cfd"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 3, 35378

GET
H2 200 2764.svg
s.w.org/images/core/emoji/11.2.0/svg/ 368 B
568 B 52ms
15ms Image
image/svg+xml 192.0.77.48
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/11.2.0/svg/2764.svg

Requested by

Host: www.harmj0y.net
URL: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

09a743ee0c32ca57c9be64b13b29c396310d1dd309cb4d7d3be722e47db95f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Mon, 04 Nov 2019 17:49:38 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Jan 2019 01:27:58 GMT
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 368
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1

200
OK

jot.html
platform.twitter.com/ Frame A46A
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

6ms
6ms

Document
text/html

2606:2800:234:59:254c:406:2366:268c
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/418C) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: http://www.harmj0y.net
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode: nested-navigate

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 04 Nov 2019 17:49:38 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Tue, 22 Oct 2019 23:03:20 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/418C)
X-Cache: HIT
Content-Length: 80

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Mon, 04 Nov 2019 17:49:38 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Mon, 04 Nov 2019 17:49:38 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_o
strict-transport-security: max-age=631138519
x-connection-hash: 2959561ae8a93fddb03c30cdd9e1808a
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 118
x-transaction: 007d5aad00a0d3da
x-tsa-request-body-time: 1
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://www.harmj0y.net/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff,nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
abs.twimg.com
cdn.syndication.twimg.com
fonts.googleapis.com
fonts.gstatic.com
gist.github.com
github.githubassets.com
pbs.twimg.com
pixel.wp.com
platform.twitter.com
s.w.org
s0.wp.com
secure.gravatar.com
stats.wp.com
syndication.twitter.com
ton.twimg.com
www.harmj0y.net
104.145.225.3
104.244.42.8
185.199.108.154
192.0.76.3
192.0.77.32
192.0.77.48
192.30.253.119
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:815::2003
2a00:1450:4001:824::200a
2a04:fa87:fffe::c000:4902
01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
09a743ee0c32ca57c9be64b13b29c396310d1dd309cb4d7d3be722e47db95f27
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33
1559aa8c42629bff9ebfb2d5c4083b9bde3b8d9d6a95c05ffe1e64832ee0dda6
174de82d4093c663f085c9b3fd303c90431670538245c9c8d1d7c2947a21abd7
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
2192a8a11b3b0968c13f8933c5fdb91355f5584681429d76567cdbd4eda32fed
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
37a3bd7bc7328f0ead2c0f6f635dddf60615e676e6b4ddf964144012e529de45
3d0c5826279971852705472c76a62b0f1b166fb6495921c42e890d07bbae046a
3e3e6358df951436d7c4e597f61f7bb0dcbfa9b99385c14a7016bd5475cd7d07
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
42044d2f67a563820783809582b367cf2195586acffb544fbc01d9c58787d435
44a2bf681f7bc4a15e5881959e21718c04532eacb5f012d0d70284bb4f7d4d0f
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
47ec7a38cec39f5149eddbcb37386cdc2b75d801d46fee7e53edb5a6284b1543
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b
525d0c63376a81b2e0e6414f51f3d9911f339545bc2288d2f0b5a1afe0a0b3cc
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
6279717c85ec0510b97c6b9e4a8426c011a458e73f2f4e355c8ff1e75736873e
630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab
643d4c503349a545d85578f353e05fd7bc2bd7576f3f22089e73cfb666131094
6e2061db4fd58afb4dd366ae2988505313a289c803e1ea3c72fe8599efa40aa1
703b134857241eccea000989b0435dde381988f53d40119744bff8d1cf828a63
760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635
7862c51c8ff9cee16f0cd466f1f1568b29a203e792f7f2f557b1c9a0092c52cb
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
7c46604c0440be3fd2d6a5e217846cde699e81422afd52625b633bc28cfe3446
7faf3e61494372b2d2c8e929e286f100306c7464521ad0c129741ac8e27d0017
8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f
99a50b833fec96a9f274d707bb567cd242ec35db35d6bc26ac391c0619304b2e
9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
9e7e71334eddfdc7344ba4ac18721dc98012faa2093f17c4142d0f150717654b
a35aae89abeaad7bc82884a8f7a81050a75fb88512989bbe7bbb0413b08ddae6
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
a8b16530224ab6db50c2ab417f171752a84d8f1fb5e241057ab94c4c4f4bd0c3
a8cfafcd5e63088eedf5a8e2ee90f7d6330fc072f63a4b515270e7fa377321b6
a9609578d22eb71f002d3f184a6841bb5a4bfe964e4e2e1c51733ea53b7c5812
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
c53261c30acc3dbfd08bbe8baa920cc595fed119faec575a66cd100d85efa0a9
c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c
cff92a7eb12d555a40c2c94c90f8b23009c1a7298e15b47d6f7ae6b744fdac15
d592fa9c8989da648bc537f44ba55b7e60b6eb88557eaef9c2ddcb4eea74a906
dce60247f8fe8382f96de643513d7d0e06af9178c362779050f9e0af90644c2e
dec22d665719520caba542fe8f59e42c4fb088143ff0e2d255374723ec2605a7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ea602e3d9e87bcd7e368fdb7931ee6e21bf15d167c977f8922e095a7b4d8b462
eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f452b1e5c1cae40dc81a9da7605dd6b98d0a06253d9b363e11c99ec4081ace4c
f5b5ac5fdb8870504505be0a9522061f905e5c1b25a927f877303785129cb3f9

www.harmj0y.net Open in urlscan Pro 104.145.225.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

70 Requests

40 %HTTPS

42 %IPv6

10 Domains

18 Subdomains

13 IPs

3 Countries

1079 kBTransfer

1685 kBSize

0 Cookies

29 Outgoing links

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.harmj0y.net Open in urlscan Pro
104.145.225.3 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

40 %
HTTPS

42 %
IPv6

10
Domains

18
Subdomains

13
IPs

3
Countries

1079 kB
Transfer

1685 kB
Size

0
Cookies

70 HTTP transactions
5 data transactions