swarm.ptsecurity.com Open in urlscan Pro
217.73.60.13 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://signaldmain.website/click?redirect=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&dID=1620248257061&linkNam...
Effective URL:
https://swarm.ptsecurity.com/rce-cockpit-cms/
Submission: On May 06 via manual (May 6th 2021, 9:06:02 pm UTC) from PL

Summary HTTP 57 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 13 IPs in 4 countries across 12 domains to perform 57 HTTP transactions. The main IP is 217.73.60.13, located in Russian Federation and belongs to CROC_INC, RU. The main domain is swarm.ptsecurity.com.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on August 9th 2019. Valid for: 2 years.

This is the only time swarm.ptsecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.220.188.71 3.220.188.71	14618 (AMAZON-AES) (AMAZON-AES)
42	217.73.60.13 217.73.60.13	51219 (CROC_INC) (CROC_INC)
1	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2 6	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
1 2	154.47.36.120 154.47.36.120	174 (COGENT-174) (COGENT-174)
57	13

1 3.220.188.71 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-188-71.compute-1.amazonaws.com

signaldmain.website	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 217.73.60.13 (Russian Federation)

ASN51219 (CROC_INC, RU)
PTR: c2-217-73-60-13.elastic.cloud.croc.ru

swarm.ptsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8::1:119 (Moscow, Russian Federation) 2 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 154.47.36.120 (United States) 1 redirects

ASN174 (COGENT-174, US)

mc.webvisor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	ptsecurity.com swarm.ptsecurity.com	2 MB
6	yandex.ru 2 redirects mc.yandex.ru	2 KB
2	webvisor.org 1 redirects mc.webvisor.org	737 B
2	google-analytics.com www.google-analytics.com	19 KB
2	gstatic.com fonts.gstatic.com	31 KB
1	google.de www.google.de	107 B
1	google.com www.google.com	109 B
1	doubleclick.net stats.g.doubleclick.net	91 B
1	jsdelivr.net cdn.jsdelivr.net	79 KB
1	googleapis.com fonts.googleapis.com	896 B
1	googletagmanager.com www.googletagmanager.com	35 KB
1	signaldmain.website 1 redirects signaldmain.website	553 B
57	12

	Domain	Requested by
42	swarm.ptsecurity.com	swarm.ptsecurity.com
6	mc.yandex.ru	2 redirects swarm.ptsecurity.com cdn.jsdelivr.net
2	mc.webvisor.org	1 redirects
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.gstatic.com	fonts.googleapis.com
1	www.google.de
1	www.google.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdn.jsdelivr.net	swarm.ptsecurity.com
1	fonts.googleapis.com	swarm.ptsecurity.com
1	www.googletagmanager.com	swarm.ptsecurity.com
1	signaldmain.website	1 redirects
57	12

This site contains links to these domains. Also see Links.

Domain
twitter.com
github.com

Subject Issuer	Validity	Valid
*.ptsecurity.com GlobalSign RSA OV SSL CA 2018	`2019-08-09` - `2021-08-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2021-05-03` - `2022-03-26`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
mc.yandex.ru Yandex CA	`2021-02-27` - `2021-08-09`	5 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
mc.webvisor.com Yandex CA	`2021-03-11` - `2021-09-02`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://swarm.ptsecurity.com/rce-cockpit-cms/
Frame ID: 487936C7D4A053F2BB555440A4763617
Requests: 58 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://signaldmain.website/click?redirect=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&dID=1... HTTP 301
https://swarm.ptsecurity.com/rce-cockpit-cms/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

57
Requests

100 %
HTTPS

77 %
IPv6

12
Domains

12
Subdomains

13
IPs

4
Countries

2000 kB
Transfer

2234 kB
Size

6
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/ptswarm
Title: Follow @ptswarm

Search URL Search Domain Scan URL

URL: https://twitter.com/ultrayoba
Title: ultrayoba

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.1/modules/Cockpit/Controller/Auth.php#L16
Title: check

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.1/modules/Cockpit/module/auth.php#L14
Title: authenticate

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/tree/0.11.1/lib/MongoLite
Title: MongoLite

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.1/modules/Cockpit/Controller/Auth.php#L82
Title: requestreset

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.1/modules/Cockpit/Controller/Auth.php#L146
Title: resetpassword

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.1/modules/Cockpit/Controller/Auth.php#L127
Title: newpassword

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.2/lib/MongoLite/Database.php#L103
Title: registerCriteriaFunction

Search URL Search Domain Scan URL

URL: https://github.com/agentejo/cockpit/blob/0.11.2/lib/MongoLite/Database.php#L278
Title: buildCondition

Search URL Search Domain Scan URL

URL: https://github.com/ptswarm
Title: GitHub

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://signaldmain.website/click?redirect=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&dID=1620248257061&linkName=https://swarm.ptsecurity.com/rce-cockpit-cms/ HTTP 301
https://swarm.ptsecurity.com/rce-cockpit-cms/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

https://mc.yandex.ru/watch/3?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref=&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A1291239081948%3Ahid%3A382670454%3Az%3A120%3Ai%3A20210506230545%3Aet%3A1620335146%3Ac%3A1%3Arn%3A364801529%3Au%3A162033514635447448%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620335144282%3Ads%3A12%2C285%2C108%2C2%2C325%2C0%2C%2C577%2C1%2C%2C%2C%2C1313%3Adsn%3A12%2C285%2C108%2C1%2C325%2C0%2C%2C581%2C1%2C%2C%2C%2C1313%3Awv%3A2%3Ati%3A2%3Ast%3A1620335146 HTTP 302
https://mc.yandex.ru/watch/3/1?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A1291239081948%3Ahid%3A382670454%3Az%3A120%3Ai%3A20210506230545%3Aet%3A1620335146%3Ac%3A1%3Arn%3A364801529%3Au%3A162033514635447448%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620335144282%3Ads%3A12%2C285%2C108%2C2%2C325%2C0%2C%2C577%2C1%2C%2C%2C%2C1313%3Adsn%3A12%2C285%2C108%2C1%2C325%2C0%2C%2C581%2C1%2C%2C%2C%2C1313%3Awv%3A2%3Ati%3A2%3Ast%3A1620335146

Request Chain 54

https://mc.webvisor.org/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.webvisor.org&token=9265.w-MzX6NHzvi3PBUtiLHeZAixG6qPH4s-RVMPrn8xcBXiJeGJfiWgDh0ITL3SCatx.bm5naKdKXX3Y0eFgwX_ebrEXjoo%2C HTTP 302
https://mc.webvisor.org/sync_cookie_image_decide?token=9265.eIKKMHxoboqXQQwvb-g9zN1aer21-jxGwydSqnWyeRoQcg78ihNu4-sxMQMfRqcbkk_nNlAQGA_wjBg424VcppH4ZguM3rqqnEU3oFOewYQ%2C.WWHMhmGcxfTjN8-WKEW2Qhkmrm0%2C

57 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
swarm.ptsecurity.com/rce-cockpit-cms/
Redirect Chain

https://signaldmain.website/click?redirect=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&dID=1620248257061&linkName=https://swarm.ptsecurity.com/rce-cockpit-cms/
https://swarm.ptsecurity.com/rce-cockpit-cms/

30 KB
9 KB

406ms
108ms

Document
text/html

217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

5c252c5b242d2097b3ca089452eedc389963b622ab7ae016b34ce45d9d3036cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: swarm.ptsecurity.com
:scheme: https
:path: /rce-cockpit-cms/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Thu, 06 May 2021 21:05:44 GMT
content-type: text/html; charset=UTF-8
link: <https://swarm.ptsecurity.com/?p=2510>; rel=shortlink
strict-transport-security: max-age=16070400
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-encoding: gzip

Redirect headers

Server: nginx
Date: Thu, 06 May 2021 21:05:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.3.15
Location: https://swarm.ptsecurity.com/rce-cockpit-cms/
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With, XMLHttpRequest, x-csrf-token
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

GET
H2 200 style.min.css
swarm.ptsecurity.com/wp-includes/css/dist/block-library/ 57 KB
57 KB 82ms
81ms Stylesheet
text/css 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.1

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=5.7.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 15 Apr 2021 11:20:00 GMT
server: nginx
etag: "60782160-e33b"
x-frame-options: deny
content-type: text/css
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 58171
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
swarm.ptsecurity.com/wp-content/themes/swarm-2/ 97 KB
97 KB 160ms
159ms Stylesheet
text/css 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

0d842e4d7233075c9acd6f0182cb6e05d9b0ffa0d1f381e15e9268287b3a583f

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/swarm-2/style.css?ver=1.1.11
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 14:03:29 GMT
server: nginx
etag: "606f0d31-18384"
x-frame-options: deny
content-type: text/css
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 99204
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
swarm.ptsecurity.com/wp-includes/js/jquery/ 87 KB
88 KB 233ms
232ms Script
application/javascript 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/jquery/jquery.min.js?ver=3.5.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 11:53:16 GMT
server: nginx
etag: "60251aac-15d98"
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 89496
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
swarm.ptsecurity.com/wp-includes/js/jquery/ 11 KB
11 KB 233ms
233ms Script
application/javascript 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 11:53:16 GMT
server: nginx
etag: "60251aac-2bd8"
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 11224
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 38ms
30ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-171997764-1

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8683622b67bc8096f8515ea02c29d09c1ed4fba9a6a60a49d77718278939d1b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35791
x-xss-protection: 0
expires: Thu, 06 May 2021 21:05:45 GMT

GET
H2 200 thumbnail.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 169 KB
170 KB 89ms
82ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/thumbnail.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

ecf26949281b1a340214433ef3f5c2cf59d74cf02226b6ac952277c0b0f171f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/thumbnail.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 13:16:42 GMT
server: nginx
etag: "606f023a-2a467"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 173159
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 IMG_5244-scaled-e1617886840708-150x150.jpg
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 4 KB
4 KB 129ms
121ms Image
image/jpeg 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/IMG_5244-scaled-e1617886840708-150x150.jpg

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

5066f2a76a007091ec60242a0d1f2697183f8a3f66edfb98741d5b448386da30

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/IMG_5244-scaled-e1617886840708-150x150.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 13:00:41 GMT
server: nginx
etag: "606efe79-10df"
x-frame-options: deny
content-type: image/jpeg
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 4319
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 35 KB
35 KB 129ms
122ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

b40c561ed138d31ad73c4c201c6ea14f98080a1c6360eb1a7dbcc54d64aa584b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:04 GMT
server: nginx
etag: "606eec0c-8cb5"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 36021
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_authenticate_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 31 KB
31 KB 129ms
122ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_authenticate_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

870272289f76b4e868048a1f46e78af268a17b8dcca6c3f174436584cd3929c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_authenticate_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:01 GMT
server: nginx
etag: "606eec09-7b6e"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 31598
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_authenticate_src_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 19 KB
19 KB 129ms
122ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_authenticate_src_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

eea4540ac7999026d139401f4e91fb49593587ab33bc0725e8942650d143cba4

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_authenticate_src_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:01 GMT
server: nginx
etag: "606eec09-4a53"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 19027
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_1.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 57 KB
57 KB 129ms
122ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_1.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

e4b660ac678d52ce54d2fa6f42e67400f8f5953c1758f1989d828360f5815edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_1.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:01 GMT
server: nginx
etag: "606eec09-e285"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 57989
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 57 KB
58 KB 129ms
123ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

ad8deb43f444b1b81089a89fdfcf276074ecd18e1d38664d59e1631f18ef7040

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:02 GMT
server: nginx
etag: "606eec0a-e5fd"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 58877
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_3.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 57 KB
57 KB 129ms
123ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_3.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

56203c809616c5f82b8c40aae7067a71ef33e5edec3805712c23a88a2272cbcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_3.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:02 GMT
server: nginx
etag: "606eec0a-e3db"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 58331
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_4.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 58 KB
58 KB 129ms
123ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_4.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

e507879e579ad65845c4adad9e68708227a81cd023cf3b364fa1be16ae8be8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_4.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:02 GMT
server: nginx
etag: "606eec0a-e729"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 59177
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_5.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 60 KB
61 KB 129ms
123ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_5.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

bb4559125d122b5f2c0da3924de1ad08d3e3c3bb27ba5155d5c8caade2fa6b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_5.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:02 GMT
server: nginx
etag: "606eec0a-f0c8"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 61640
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_6.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 61 KB
61 KB 129ms
123ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_6.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

fd6c3cff2a5feccee2a113eb0f62cab3605b611ac197cb6c6559686cbb98dde3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_6.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:03 GMT
server: nginx
etag: "606eec0b-f388"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 62344
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_7.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 57 KB
57 KB 130ms
124ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_7.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

0344c59bdac5c9084cb7c020fe27746078741e421c0986ad27cbb3e9f181f8af

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_7.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:03 GMT
server: nginx
etag: "606eec0b-e3c9"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 58313
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_8.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 57 KB
57 KB 130ms
124ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_8.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

a82106bbfe0f41af05cfc7da0269020b9fa08a9479fd532e10c26e2842fdc28a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_8.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:03 GMT
server: nginx
etag: "606eec0b-e2ec"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 58092
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_9.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 58 KB
58 KB 130ms
124ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_9.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

6fa31234648dbe15a9f99e8f9bcb8301b12034e6b258b394ca37af27180cda27

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_9.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:04 GMT
server: nginx
etag: "606eec0c-e6d6"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 59094
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_mongolite_func_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 13 KB
14 KB 130ms
124ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_mongolite_func_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

a87e159a03652f36d7e0626d1ccd1f67e41564dbbf16e671e1ca553b8a0941c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_mongolite_func_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:08 GMT
server: nginx
etag: "606eec10-35ea"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 13802
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_check_10.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 53 KB
53 KB 130ms
125ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_check_10.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

da2b0d35b5aeb94074d4fe22fa27e2ddf1a89cdb82acfb3d9b94d66332eef6df

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_check_10.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:04 GMT
server: nginx
etag: "606eec0c-d3fd"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 54269
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_requestreset_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 14 KB
14 KB 130ms
125ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_requestreset_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

ee44784b542ec3ab0be91d780e056999736f411a899cd574d11e8de16bcfbba0

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_requestreset_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:07 GMT
server: nginx
etag: "606eec0f-3668"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 13928
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_requestreset_1.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 48 KB
49 KB 130ms
125ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_requestreset_1.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

83b7b39189ba3beee2ca0ed7ddfee7b83f946e9281952a1bb26d9f8a3ebeea99

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_requestreset_1.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:06 GMT
server: nginx
etag: "606eec0e-c0f3"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 49395
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_resetpassword_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 7 KB
8 KB 130ms
125ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_resetpassword_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

3737c76accd256621c80bb7efea86c66d98d452b22059065f5ae71fd483097ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_resetpassword_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:07 GMT
server: nginx
etag: "606eec0f-1d22"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 7458
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_resetpassword_1.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 51 KB
51 KB 131ms
125ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_resetpassword_1.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

97c2b0a79eab20084ab74c71b5e577906ca196924667e79f52f397dc9de8d288

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_resetpassword_1.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:07 GMT
server: nginx
etag: "606eec0f-cb0f"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 51983
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_newpassword_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 7 KB
7 KB 131ms
126ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_newpassword_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

68427678397c6398b12a78c2e6a05d502a1366193ef1229e895f2c95c832ec26

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_newpassword_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:06 GMT
server: nginx
etag: "606eec0e-1cca"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 7370
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_newpassword_1.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 51 KB
51 KB 131ms
126ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_newpassword_1.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

f7baf13ad48b8e1fb8aaa459922eca6ab57c8867474c8512336c5a799b0918d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_newpassword_1.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:05 GMT
server: nginx
etag: "606eec0d-cc45"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 52293
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_requestreset_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 43 KB
43 KB 131ms
126ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_requestreset_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

d8218f1e4031c9ba3204b1c34969b2b940158ad53183d31d95ab6df331a33b54

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_requestreset_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:06 GMT
server: nginx
etag: "606eec0e-ac32"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 44082
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_newpassword_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 64 KB
65 KB 131ms
126ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_newpassword_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

f78623249196e6e93af90b9d6e00b16cd93158578418f5d7747362e8c2086457

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_newpassword_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:05 GMT
server: nginx
etag: "606eec0d-101ca"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 65994
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_newpassword_3.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 66 KB
66 KB 131ms
127ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_newpassword_3.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

87a622c7d0169cd0ff1d6c4f667adae4ad002f38eabac1bfc5202b299c6e6018

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_newpassword_3.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:05 GMT
server: nginx
etag: "606eec0d-10652"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 67154
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_auth_resetpassword_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 58 KB
58 KB 131ms
127ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_auth_resetpassword_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

e93380d338a28b672cc05ff0a11154f73d301460c8a4dcdd58f5778657b69318

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_auth_resetpassword_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:07 GMT
server: nginx
etag: "606eec0f-e6c0"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 59072
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_finder_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 60 KB
61 KB 131ms
127ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_finder_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

7cc06b5c089678aa4c5bca741689edd7587e378d3603ad33e798f2a7ec70c197

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_finder_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:08 GMT
server: nginx
etag: "606eec10-f183"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 61827
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_shell_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 19 KB
19 KB 131ms
127ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_shell_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

3c61a21bccd033beb15eabcb8e356e1a8047e7a497ebe2959d2d4aa8c7eef78e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_shell_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:10 GMT
server: nginx
etag: "606eec12-4a0a"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 18954
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_mongolite_phpinj_src_2.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 20 KB
20 KB 131ms
128ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_mongolite_phpinj_src_2.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

b9fed3a18b8365fc8cc80e5f71e5e5b059283e016bceae8c2b6800c27172c074

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_mongolite_phpinj_src_2.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:09 GMT
server: nginx
etag: "606eec11-503c"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 20540
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_mongolite_phpinj_src.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 32 KB
33 KB 131ms
128ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_mongolite_phpinj_src.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

0e1729a4716bf68f7944a0ee16f9c1b10deaeb59edf424f7c109f2881f640633

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_mongolite_phpinj_src.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:09 GMT
server: nginx
etag: "606eec11-81dc"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 33244
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cockpit_mongolite_phpinj_rce.png
swarm.ptsecurity.com/wp-content/uploads/2021/04/ 53 KB
53 KB 131ms
128ms Image
image/png 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/uploads/2021/04/cockpit_mongolite_phpinj_rce.png

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

d37b8798235f19b631495353cfc99e785400418b74d5365058499ba2dd6ff28f

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/uploads/2021/04/cockpit_mongolite_phpinj_rce.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 08 Apr 2021 11:42:09 GMT
server: nginx
etag: "606eec11-d21e"
x-frame-options: deny
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 53790
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bundle.js Show response
swarm.ptsecurity.com/wp-content/themes/swarm-2/js/ 102 KB
103 KB 81ms
81ms Script
application/javascript 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-content/themes/swarm-2/js/bundle.js?ver=1.1.11

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

825fca0ee81bcb0886877f3781de8896611579507a2d59b9b52761300f8e3614

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/swarm-2/js/bundle.js?ver=1.1.11
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Fri, 17 Jul 2020 14:26:33 GMT
server: nginx
etag: "5f11b519-199f5"
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 104949
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-embed.min.js Show response
swarm.ptsecurity.com/wp-includes/js/ 1 KB
2 KB 83ms
82ms Script
application/javascript 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-includes/js/wp-embed.min.js?ver=5.7.1

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.7.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 11:53:16 GMT
server: nginx
etag: "60251aac-592"
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 1426
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-emoji-release.min.js Show response
swarm.ptsecurity.com/wp-includes/js/ 14 KB
14 KB 132ms
128ms Script
application/javascript 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to

Full URL

https://swarm.ptsecurity.com/wp-includes/js/wp-emoji-release.min.js?ver=5.7.1

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.7.1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/rce-cockpit-cms/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 11:53:16 GMT
server: nginx
etag: "60251aac-3795"
x-frame-options: deny
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 14229
x-xss-protection: 1; mode=block
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
896 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&display=swap

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca25a465973b5c37c86527a1874120e5e64cb0d22181ce132a932a91b11e58cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 06 May 2021 20:08:59 GMT
server: ESF
date: Thu, 06 May 2021 21:05:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 06 May 2021 21:05:45 GMT

GET
H2 200 tag.js Show response
cdn.jsdelivr.net/npm/yandex-metrica-watch/ 216 KB
79 KB 53ms
50ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/yandex-metrica-watch/tag.js

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8cc9e151276dca89769b6311e764972fb6fd95d218d8e6fea317d47c1aa7d8a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 34086
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 81100
etag: W/"35eae-LUw1h0jekim2QA40+7dtuKeyOyo"
x-served-by: cache-fra19166-FRA, cache-hhn4046-HHN
date: Thu, 06 May 2021 21:05:45 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
DATA 200
OK truncated
/ 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 twitter.svg
swarm.ptsecurity.com/wp-content/themes/swarm-2/img/ 1 KB
1 KB 129ms
128ms Image
image/svg+xml 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/themes/swarm-2/img/twitter.svg

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

510d47804f2b24f1117280edfd4b5f36a5ebe64fbacb989a9ff4b60fb91f91f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/swarm-2/img/twitter.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jun 2020 11:50:42 GMT
server: nginx
etag: "5ee8b212-43d"
x-frame-options: deny
content-type: image/svg+xml
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 1085
x-xss-protection: 1; mode=block

GET
H2 200 tag.svg
swarm.ptsecurity.com/wp-content/themes/swarm-2/img/ 281 B
503 B 128ms
126ms Image
image/svg+xml 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/themes/swarm-2/img/tag.svg

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

59d8ccaeb23d40e8dfc8f23c0465636a4cdaa394b31c00572dcad36158a6a2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/swarm-2/img/tag.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 03 Jun 2020 15:17:25 GMT
server: nginx
etag: "5ed7bf05-119"
x-frame-options: deny
content-type: image/svg+xml
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 281
x-xss-protection: 1; mode=block

GET
H2 200 github.svg
swarm.ptsecurity.com/wp-content/themes/swarm-2/img/ 1 KB
1 KB 127ms
127ms Image
image/svg+xml 217.73.60.13
CROC_INC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://swarm.ptsecurity.com/wp-content/themes/swarm-2/img/github.svg

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

217.73.60.13 , Russian Federation, ASN51219 (CROC_INC, RU),

Reverse DNS

c2-217-73-60-13.elastic.cloud.croc.ru

Software

nginx /

Resource Hash

f4a089afd2a85f844223637fe5c03863f193ca4a656d71fcced949505f186d2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

:path: /wp-content/themes/swarm-2/img/github.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: swarm.ptsecurity.com
referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://swarm.ptsecurity.com/wp-content/themes/swarm-2/style.css?ver=1.1.11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 16 Jun 2020 11:53:48 GMT
server: nginx
etag: "5ee8b2cc-4a3"
x-frame-options: deny
content-type: image/svg+xml
strict-transport-security: max-age=16070400
accept-ranges: bytes
content-length: 1187
x-xss-protection: 1; mode=block

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://swarm.ptsecurity.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 15:35:29 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 19816
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Fri, 06 May 2022 15:35:29 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://swarm.ptsecurity.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 01:43:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 69733
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Fri, 06 May 2022 01:43:32 GMT

GET
H2

200

1 Show response
mc.yandex.ru/watch/3/
Redirect Chain

https://mc.yandex.ru/watch/3?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref=&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Af...
https://mc.yandex.ru/watch/3/1?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3A...

35 B
69 B

46ms
46ms

XHR
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/3/1?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A1291239081948%3Ahid%3A382670454%3Az%3A120%3Ai%3A20210506230545%3Aet%3A1620335146%3Ac%3A1%3Arn%3A364801529%3Au%3A162033514635447448%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620335144282%3Ads%3A12%2C285%2C108%2C2%2C325%2C0%2C%2C577%2C1%2C%2C%2C%2C1313%3Adsn%3A12%2C285%2C108%2C1%2C325%2C0%2C%2C581%2C1%2C%2C%2C%2C1313%3Awv%3A2%3Ati%3A2%3Ast%3A1620335146

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

efbdf9cab6b6cf2bf7207ae4e0456c9462b2c0d4c2de76d65442de2af7253f2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Thu, 06-May-2021 21:05:45 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 35
x-xss-protection: 1; mode=block
expires: Thu, 06-May-2021 21:05:45 GMT

Redirect headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:45 GMT
last-modified: Thu, 06-May-2021 21:05:45 GMT
location: /watch/3/1?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&page-ref&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A2%3Adp%3A0%3Als%3A1291239081948%3Ahid%3A382670454%3Az%3A120%3Ai%3A20210506230545%3Aet%3A1620335146%3Ac%3A1%3Arn%3A364801529%3Au%3A162033514635447448%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620335144282%3Ads%3A12%2C285%2C108%2C2%2C325%2C0%2C%2C577%2C1%2C%2C%2C%2C1313%3Adsn%3A12%2C285%2C108%2C1%2C325%2C0%2C%2C581%2C1%2C%2C%2C%2C1313%3Awv%3A2%3Ati%3A2%3Ast%3A1620335146
strict-transport-security: max-age=31536000
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Thu, 06-May-2021 21:05:45 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-171997764-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 2333
date: Thu, 06 May 2021 20:26:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Thu, 06 May 2021 22:26:52 GMT

GET
H2 200 advert.gif
mc.yandex.ru/metrika/ 43 B
165 B 45ms
45ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/metrika/advert.gif

Requested by

Host: swarm.ptsecurity.com
URL: https://swarm.ptsecurity.com/rce-cockpit-cms/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:45 GMT
last-modified: Fri, 30 Apr 2021 17:14:07 GMT
etag: "608a4fd7-2b"
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 43
expires: Thu, 06 May 2021 22:05:45 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 13ms
13ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1341817655&t=pageview&_s=1&dl=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&ul=en-us&de=UTF-8&dt=From%200%20to%20RCE%3A%20Cockpit%20CMS%20%E2%80%93%20PT%20SWARM&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1395184391&gjid=1217735592&cid=1101020060.1620335146&tid=UA-171997764-1&_gid=368873460.1620335146&_r=1&gtm=2ou4s0&z=2015113227

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
91 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-171997764-1&cid=1101020060.1620335146&jid=1395184391&gjid=1217735592&_gid=368873460.1620335146&_u=YEBAAUAAAAAAAC~&z=1152375998

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 06 May 2021 21:05:45 GMT
content-type: text/plain
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
109 B 17ms
17ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-171997764-1&cid=1101020060.1620335146&jid=1395184391&_u=YEBAAUAAAAAAAC~&z=162877451

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
29ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-171997764-1&cid=1101020060.1620335146&jid=1395184391&_u=YEBAAUAAAAAAAC~&z=162877451

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync_cookie_image_decide
mc.webvisor.org/
Redirect Chain

https://mc.webvisor.org/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.webvisor.org&token=9265.w-MzX6NHzvi3PBUtiLHeZAixG6qPH4s-RVMPrn8xcBXiJeGJfiWgDh0ITL3SCatx.bm5naKdKXX3Y0eFgwX_ebrEXjoo%2C
https://mc.webvisor.org/sync_cookie_image_decide?token=9265.eIKKMHxoboqXQQwvb-g9zN1aer21-jxGwydSqnWyeRoQcg78ihNu4-sxMQMfRqcbkk_nNlAQGA_wjBg424VcppH4ZguM3rqqnEU3oFOewYQ%2C.WWHMhmGcxfTjN8-WKEW2Qhkmrm...

43 B
383 B

69ms
69ms

Image
image/gif

154.47.36.120
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.webvisor.org/sync_cookie_image_decide?token=9265.eIKKMHxoboqXQQwvb-g9zN1aer21-jxGwydSqnWyeRoQcg78ihNu4-sxMQMfRqcbkk_nNlAQGA_wjBg424VcppH4ZguM3rqqnEU3oFOewYQ%2C.WWHMhmGcxfTjN8-WKEW2Qhkmrm0%2C

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

154.47.36.120 , United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 06 May 2021 21:05:46 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.webvisor.org/sync_cookie_image_decide?token=9265.eIKKMHxoboqXQQwvb-g9zN1aer21-jxGwydSqnWyeRoQcg78ihNu4-sxMQMfRqcbkk_nNlAQGA_wjBg424VcppH4ZguM3rqqnEU3oFOewYQ%2C.WWHMhmGcxfTjN8-WKEW2Qhkmrm0%2C
date: Thu, 06 May 2021 21:05:45 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 66262255 Show response
mc.yandex.ru/watch/ 219 B
325 B 46ms
46ms XHR
application/json 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/watch/66262255?wmode=7&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A5gv0p5wzeb54045a%3Afp%3A1285%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A504%3Acn%3A1%3Adp%3A0%3Als%3A890696065950%3Ahid%3A382670454%3Az%3A120%3Ai%3A20210506230545%3Aet%3A1620335146%3Ac%3A1%3Arn%3A527419605%3Au%3A162033514635447448%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1620335144282%3Ads%3A12%2C285%2C108%2C2%2C325%2C0%2C%2C577%2C1%2C%2C%2C%2C1313%3Adsn%3A12%2C285%2C108%2C1%2C325%2C0%2C%2C581%2C1%2C%2C%2C%2C1313%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1620335146%3At%3AFrom%200%20to%20RCE%3A%20Cockpit%20CMS%20%E2%80%93%20PT%20SWARM

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/yandex-metrica-watch/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

422e7cb38b7221d449f35ed1eca777d0cfa94770488bf25c7dc8e575c17a79e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:46 GMT
x-content-type-options: nosniff
last-modified: Thu, 06-May-2021 21:05:46 GMT
strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 219
x-xss-protection: 1; mode=block
expires: Thu, 06-May-2021 21:05:46 GMT

POST
H2 200 66262255 Show response
mc.yandex.ru/webvisor/ 43 B
145 B 46ms
46ms XHR
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/66262255?wmode=0&wv-part=1&wv-hit=382670454&page-url=https%3A%2F%2Fswarm.ptsecurity.com%2Frce-cockpit-cms%2F&rn=997114683&wv-type=5&browser-info=gdpr%3A14%3Aet%3A1620335148%3Aw%3A1600x1200%3Av%3A504%3Az%3A120%3Ai%3A20210506230548%3Au%3A162033514635447448%3Avf%3A5gv0p5wzeb54045a%3Ati%3A2%3Ast%3A1620335148

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/yandex-metrica-watch/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://swarm.ptsecurity.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 06 May 2021 21:05:48 GMT
last-modified: Thu, 06-May-2021 21:05:48 GMT
strict-transport-security: max-age=31536000
content-type: image/gif
access-control-allow-origin: https://swarm.ptsecurity.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 06-May-2021 21:05:48 GMT

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ptsecurity.com/	1970-01-19 18:06:47	Name: _ym_isad Value: 2
.ptsecurity.com/	1970-01-20 02:51:11	Name: _ym_d Value: 1620335146
.ptsecurity.com/	1970-01-19 18:07:01	Name: _gid Value: GA1.2.368873460.1620335146
.ptsecurity.com/	1970-01-19 18:05:35	Name: _gat_gtag_UA_171997764_1 Value: 1
.ptsecurity.com/	1970-01-20 11:36:47	Name: _ga Value: GA1.2.1101020060.1620335146
.ptsecurity.com/	1970-01-20 02:51:11	Name: _ym_uid Value: 162033514635447448

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://swarm.ptsecurity.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
mc.webvisor.org
mc.yandex.ru
signaldmain.website
stats.g.doubleclick.net
swarm.ptsecurity.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
154.47.36.120
217.73.60.13
2a00:1450:4001:808::200e
2a00:1450:4001:811::2008
2a00:1450:4001:813::200a
2a00:1450:4001:829::2003
2a00:1450:4001:829::200e
2a00:1450:4001:830::2003
2a00:1450:4001:831::2004
2a00:1450:400c:c04::9d
2a02:6b8::1:119
2a04:4e42:1b::621
3.220.188.71
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0344c59bdac5c9084cb7c020fe27746078741e421c0986ad27cbb3e9f181f8af
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0d842e4d7233075c9acd6f0182cb6e05d9b0ffa0d1f381e15e9268287b3a583f
0e1729a4716bf68f7944a0ee16f9c1b10deaeb59edf424f7c109f2881f640633
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
3737c76accd256621c80bb7efea86c66d98d452b22059065f5ae71fd483097ec
3c61a21bccd033beb15eabcb8e356e1a8047e7a497ebe2959d2d4aa8c7eef78e
422e7cb38b7221d449f35ed1eca777d0cfa94770488bf25c7dc8e575c17a79e2
5066f2a76a007091ec60242a0d1f2697183f8a3f66edfb98741d5b448386da30
510d47804f2b24f1117280edfd4b5f36a5ebe64fbacb989a9ff4b60fb91f91f3
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56203c809616c5f82b8c40aae7067a71ef33e5edec3805712c23a88a2272cbcc
59d8ccaeb23d40e8dfc8f23c0465636a4cdaa394b31c00572dcad36158a6a2d2
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c252c5b242d2097b3ca089452eedc389963b622ab7ae016b34ce45d9d3036cf
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
68427678397c6398b12a78c2e6a05d502a1366193ef1229e895f2c95c832ec26
6fa31234648dbe15a9f99e8f9bcb8301b12034e6b258b394ca37af27180cda27
7cc06b5c089678aa4c5bca741689edd7587e378d3603ad33e798f2a7ec70c197
825fca0ee81bcb0886877f3781de8896611579507a2d59b9b52761300f8e3614
83b7b39189ba3beee2ca0ed7ddfee7b83f946e9281952a1bb26d9f8a3ebeea99
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8683622b67bc8096f8515ea02c29d09c1ed4fba9a6a60a49d77718278939d1b4
870272289f76b4e868048a1f46e78af268a17b8dcca6c3f174436584cd3929c8
87a622c7d0169cd0ff1d6c4f667adae4ad002f38eabac1bfc5202b299c6e6018
8cc9e151276dca89769b6311e764972fb6fd95d218d8e6fea317d47c1aa7d8a1
97c2b0a79eab20084ab74c71b5e577906ca196924667e79f52f397dc9de8d288
a82106bbfe0f41af05cfc7da0269020b9fa08a9479fd532e10c26e2842fdc28a
a87e159a03652f36d7e0626d1ccd1f67e41564dbbf16e671e1ca553b8a0941c3
ad8deb43f444b1b81089a89fdfcf276074ecd18e1d38664d59e1631f18ef7040
b40c561ed138d31ad73c4c201c6ea14f98080a1c6360eb1a7dbcc54d64aa584b
b9fed3a18b8365fc8cc80e5f71e5e5b059283e016bceae8c2b6800c27172c074
bb4559125d122b5f2c0da3924de1ad08d3e3c3bb27ba5155d5c8caade2fa6b89
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
ca25a465973b5c37c86527a1874120e5e64cb0d22181ce132a932a91b11e58cb
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d37b8798235f19b631495353cfc99e785400418b74d5365058499ba2dd6ff28f
d8218f1e4031c9ba3204b1c34969b2b940158ad53183d31d95ab6df331a33b54
da2b0d35b5aeb94074d4fe22fa27e2ddf1a89cdb82acfb3d9b94d66332eef6df
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e4b660ac678d52ce54d2fa6f42e67400f8f5953c1758f1989d828360f5815edf
e507879e579ad65845c4adad9e68708227a81cd023cf3b364fa1be16ae8be8cd
e93380d338a28b672cc05ff0a11154f73d301460c8a4dcdd58f5778657b69318
ecf26949281b1a340214433ef3f5c2cf59d74cf02226b6ac952277c0b0f171f3
ee44784b542ec3ab0be91d780e056999736f411a899cd574d11e8de16bcfbba0
eea4540ac7999026d139401f4e91fb49593587ab33bc0725e8942650d143cba4
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbdf9cab6b6cf2bf7207ae4e0456c9462b2c0d4c2de76d65442de2af7253f2b
f4a089afd2a85f844223637fe5c03863f193ca4a656d71fcced949505f186d2c
f78623249196e6e93af90b9d6e00b16cd93158578418f5d7747362e8c2086457
f7baf13ad48b8e1fb8aaa459922eca6ab57c8867474c8512336c5a799b0918d9
fd6c3cff2a5feccee2a113eb0f62cab3605b611ac197cb6c6559686cbb98dde3

swarm.ptsecurity.com Open in urlscan Pro 217.73.60.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

57 Requests

100 %HTTPS

77 %IPv6

12 Domains

12 Subdomains

13 IPs

4 Countries

2000 kBTransfer

2234 kBSize

6 Cookies

11 Outgoing links

Page URL History

Redirected requests

57 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

swarm.ptsecurity.com Open in urlscan Pro
217.73.60.13 Public Scan

Screenshot
Live screenshot

Full Image

57
Requests

100 %
HTTPS

77 %
IPv6

12
Domains

12
Subdomains

13
IPs

4
Countries

2000 kB
Transfer

2234 kB
Size

6
Cookies

57 HTTP transactions
1 data transactions