blog.cobaltstrike.com Open in urlscan Pro
192.0.78.13 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.cobaltstrike.com/
Effective URL:
https://blog.cobaltstrike.com/
Submission: On September 01 via api (September 1st 2020, 2:09:23 pm UTC) from US

Summary HTTP 69 Redirects Links 84 Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 6 domains to perform 69 HTTP transactions. The main IP is 192.0.78.13, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is blog.cobaltstrike.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 5th 2020. Valid for: 3 months.

This is the only time blog.cobaltstrike.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	192.0.78.13 192.0.78.13	2635 (AUTOMATTIC) (AUTOMATTIC)
18	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
7	192.0.72.27 192.0.72.27	2635 (AUTOMATTIC) (AUTOMATTIC)
12	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::6814:aa2e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
14	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
10	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	192.0.78.18 192.0.78.18	2635 (AUTOMATTIC) (AUTOMATTIC)
69	11

2 192.0.78.13 (San Francisco, United States) 1 redirects

ASN2635 (AUTOMATTIC, US)

blog.cobaltstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 192.0.72.27 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

rsmudge.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6814:aa2e (United States)

ASN13335 (CLOUDFLARENET, US)

www.cobaltstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.18 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	wp.com s0.wp.com stats.wp.com pixel.wp.com	191 KB
13	youtube.com www.youtube.com
10	facebook.com graph.facebook.com	3 KB
8	wordpress.com rsmudge.files.wordpress.com r-login.wordpress.com	537 KB
4	cobaltstrike.com 1 redirects blog.cobaltstrike.com www.cobaltstrike.com	300 KB
3	gravatar.com 0.gravatar.com	10 KB
69	6

	Domain	Requested by
18	s0.wp.com	blog.cobaltstrike.com
13	pixel.wp.com	blog.cobaltstrike.com
13	www.youtube.com	blog.cobaltstrike.com
10	graph.facebook.com	s0.wp.com
7	rsmudge.files.wordpress.com	blog.cobaltstrike.com s0.wp.com
3	0.gravatar.com	blog.cobaltstrike.com 0.gravatar.com
2	www.cobaltstrike.com	blog.cobaltstrike.com
2	blog.cobaltstrike.com	1 redirects
1	r-login.wordpress.com	blog.cobaltstrike.com
1	stats.wp.com	blog.cobaltstrike.com
69	10

This site contains links to these domains. Also see Links.

Domain
youtu.be
www.cobaltstrike.com
www.exploit-monday.com
phrack.org
verify.cobaltstrike.com
github.com
www.helpsystems.com
www.coresecurity.com
enigma0x3.net
www.youtube.com
docs.microsoft.com
cobaltstrike.com
attack.mitre.org
medium.com
www.cyberbit.com
blog.xpnsec.com
www.ultimatewindowssecurity.com
zerosum0x0.blogspot.com
modexp.wordpress.com
vimeo.com
www.blackhat.com
blog.chromium.org
chromium.googlesource.com
www.sekoia.fr
bugzilla.mozilla.org
trial.cobaltstrike.com
censys.io
en.wikipedia.org
www.metasploit.com
engineering.salesforce.com
matt.ucc.asn.au
twitter.com
www.twitter.com
shmoocon.org
wordpress.com
rsmudge.wordpress.com
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com Let's Encrypt Authority X3	`2020-07-05` - `2020-10-03`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2019-01-15` - `2021-01-14`	2 years	crt.sh
www.cobaltstrike.com DigiCert SHA2 Secure Server CA	`2018-09-05` - `2020-09-22`	2 years	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh

This page contains 15 frames:

Primary Page: https://blog.cobaltstrike.com/
Frame ID: 5539F19D6AB81FEA8570D1CF51D50A89
Requests: 56 HTTP requests in this frame

Frame: https://www.youtube.com/embed/gfYswA_Ronw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: AA4B68CDA673460CDE23691142F7C717
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/0AOQqd6OQzk?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: F0A710357A31C800AACFBE6A9AE8573A
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/QlotGFMuRBA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: 193EC55D83F7E19B9D35449023212074
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/dNC5HKwmbyI?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: 2F94152DF2F84D1AE5AFEA41D0BCF70A
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/yTIeeMVetfw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: BB0C3FD294C73C30539CD45375A8A40D
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/videoseries?list=PL9HO6M_MU2nfQ4kHSCzAQMqxQxH47d1no&hl=en_US
Frame ID: 55CA5CC807BF4293EFEFFB7E1F43C7C0
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/35kUS6WQm84?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: F46B01065D67E94B9AA9657AF911D3E7
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/jNqgMvlxyfM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: A19656FD2D6391F0C4C4D319EC4A9FCA
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/1-3JAkuZNd0?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: C2B6E2916ECE9544BED0B2B9FE2C52EA
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/mS7rBne3CRA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: 3A108263B906D42BFDAC7494E430DE9E
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/lu363dcAslU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: BAB2EB8D66733B8086BDE1B886D2B7A1
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/AV4XjxYe4GM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: 91FE31BAF378F11E2EAAF0D60BFE503F
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/fDs9av_pBaU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: ED4011A313F75963C4A931ED92A8EA2E
Requests: 1 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9ibG9nLmNvYmFsdHN0cmlrZS5jb20%3D&wpcomid=28734211&time=1598969344
Frame ID: 2C51D6B4148471A465AAE854A5AA4159
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://blog.cobaltstrike.com/ HTTP 301
https://blog.cobaltstrike.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

69
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

10
Subdomains

11
IPs

3
Countries

1048 kB
Transfer

1733 kB
Size

3
Cookies

84 Outgoing links

These are links going to different origins than the main page.

URL: https://youtu.be/Pb6yvcB2aYw?t=620
Title: fork&run mechanism

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-beacon-object-files
Title: Beacon Object Files

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/downloads/beacon.h
Title: some internal Beacon APIs

Search URL Search Domain Scan URL

URL: http://www.exploit-monday.com/2013/08/writing-optimized-windows-shellcode-in-c.html
Title: C coding tricks or carefully crafted compiler and linker switches

Search URL Search Domain Scan URL

URL: http://phrack.org/issues/63/15.html
Title: NT Shellcode Prevention Demystified article

Search URL Search Domain Scan URL

URL: https://youtu.be/Pb6yvcB2aYw?t=4639
Title: a detection based on this behavior

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-artifact-kit
Title: Artifact Kit

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-resource-kit
Title: Resource Kit (PowerShell only)

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/aggressor-script/functions.html#payload_local
Title: &payload_local

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-postex
Title: Malleable C2 profile

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/releasenotes.txt
Title: release notes

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-update-cobalt-strike
Title: run the update program

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/download
Title: download the latest distribution package

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/special
Title: contact us for a quote

Search URL Search Domain Scan URL

URL: https://verify.cobaltstrike.com/
Title: verify.cobaltstrike.com

Search URL Search Domain Scan URL

URL: https://github.com/infobyte/evilgrade
Title: update poisoning friends

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/
Title: HelpSystems, LLC

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/
Title: Cobalt Strike product

Search URL Search Domain Scan URL

URL: https://www.coresecurity.com/
Title: Core Security

Search URL Search Domain Scan URL

URL: https://www.coresecurity.com/core-impact
Title: Core Impact

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/about/news/helpsystems-acquires-cobalt-strike-expand-core-security-business
Title: https://www.helpsystems.com/about/news/helpsystems-acquires-cobalt-strike-expand-core-security-business

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-dns-beacon
Title: DNS Beacon

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-c2
Title: Malleable C2

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-c2#variant
Title: profile variants

Search URL Search Domain Scan URL

URL: https://youtu.be/0AOQqd6OQzk?t=1004
Title: 16:44

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-listener-management
Title: listener management UX

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-postex#postex
Title: spawnto value

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-postex#processinject
Title: process-inject configuration

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/aggressor-script/beacon.html
Title: add jump modules

Search URL Search Domain Scan URL

URL: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
Title: technique to execute a payload via DCOM

Search URL Search Domain Scan URL

URL: https://github.com/rsmudge/ElevateKit
Title: a list of command elevators

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-oneliner
Title: PowerShell one-liner

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/training
Title: The Red Team Operations with Cobalt Strike

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=QvQerXsPSvc
Title: Applet Kit

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess
Title: OpenProcess

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-postex#memory
Title: stage block

Search URL Search Domain Scan URL

URL: https://cobaltstrike.com/help-malleable-postex#postex
Title: post-ex block

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1009/
Title: Binary padding

Search URL Search Domain Scan URL

URL: https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
Title: a potential indicator

Search URL Search Domain Scan URL

URL: https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/
Title: early bird injection technique

Search URL Search Domain Scan URL

URL: https://www.cyberbit.com/
Title: Cyberbit

Search URL Search Domain Scan URL

URL: https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/
Title: Get-InjectedThread

Search URL Search Domain Scan URL

URL: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?source=Sysmon&eventID=8
Title: Sysmon event 8

Search URL Search Domain Scan URL

URL: https://github.com/rapid7/metasploit-payloads/blob/18ed237c1d9ae70030d1b01e64eb67b2c75fa9db/c/meterpreter/source/common/arch/win/i386/base_inject.c#L346
Title: comes from Meterpreter

Search URL Search Domain Scan URL

URL: https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x64/src/migrate/remotethread.asm#L62
Title: RWX stub

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-authorization-files
Title: attribute the end-user

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-corp-compliance-ethics
Title: Corporate Compliance and Ethics

Search URL Search Domain Scan URL

URL: https://zerosum0x0.blogspot.com/2017/06/proposed-eafemet-bypass-for-reflective.html
Title: embed key function pointers

Search URL Search Domain Scan URL

URL: https://modexp.wordpress.com/2017/01/15/shellcode-resolving-api-addresses/
Title: shellcode-like behavior

Search URL Search Domain Scan URL

URL: https://vimeo.com/190835447
Title: watching memory reads

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/docs/us-16/materials/us-16-Yavo-Captain-Hook-Pirating-AVs-To-Bypass-Exploit-Mitigations-wp.pdf
Title: hooking functions

Search URL Search Domain Scan URL

URL: https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html
Title: Chrome users were 15% more likely to experience a crash

Search URL Search Domain Scan URL

URL: https://chromium.googlesource.com/chromium/src/sandbox/+/master/win/src/process_mitigations.cc#420
Title: block these DLLs

Search URL Search Domain Scan URL

URL: https://www.sekoia.fr/blog/microsoft-edge-binary-injection-mitigation-overview/
Title: binary security policy attribute

Search URL Search Domain Scan URL

URL: https://bugzilla.mozilla.org/show_bug.cgi?id=1378417#c0
Title: restricts DLL loads to Microsoft-signed DLLs only

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-process-browser

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-file-browser

Search URL Search Domain Scan URL

URL: https://trial.cobaltstrike.com/
Title: 21-day Cobalt Strike trial

Search URL Search Domain Scan URL

URL: https://censys.io/
Title: search for the SHA-256 hash

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Bogon_filtering
Title: bogon IP

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-c2#validssl
Title: a valid SSL certificate

Search URL Search Domain Scan URL

URL: https://www.metasploit.com/
Title: Metasploit Framework

Search URL Search Domain Scan URL

URL: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967
Title: JA3S fingerprint

Search URL Search Domain Scan URL

URL: https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki#https
Title: Red Team Infrastructure Wiki

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-tcp-beacon
Title: TCP Beacon

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-pivot-listener
Title: Pivot Listeners

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-staged-exe
Title: export a stageless TCP Beacon artifact

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-ssh
Title: SSH sessions

Search URL Search Domain Scan URL

URL: https://matt.ucc.asn.au/dropbear/dropbear.html
Title: dropbear

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=l8nkXCOYQC4
Title: Red Teaming in the EDR Age

Search URL Search Domain Scan URL

URL: https://twitter.com/joehowwolf
Title: Will Burgess

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=AV4XjxYe4GM
Title: a payload that could obfuscate itself in memory

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-c2#memory
Title: your Malleable C2 profile

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/help-malleable-c2#processinject
Title: Malleable C2 process-inject

Search URL Search Domain Scan URL

URL: https://youtu.be/RoqVunX_sqA?t=22m25s
Title: operate without PowerShell

Search URL Search Domain Scan URL

URL: http://www.twitter.com/armitagehacker
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/contact
Title: Contact Information

Search URL Search Domain Scan URL

URL: http://shmoocon.org/
Title: ShmooCon

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_blog
Title: Blog at WordPress.com.

Search URL Search Domain Scan URL

URL: https://rsmudge.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Frsmudge.wordpress.com%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fblog.cobaltstrike.com%2F2020%2F06%2F25%2Fcobalt-strike-4-1-the-mark-of-injection%2F&signup_flow=account&domain=blog.cobaltstrike.com
Title: Log in

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.cobaltstrike.com/ HTTP 301
https://blog.cobaltstrike.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

69 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
blog.cobaltstrike.com/
Redirect Chain

http://blog.cobaltstrike.com/
https://blog.cobaltstrike.com/

152 KB
42 KB

362ms
314ms

Document
text/html

192.0.78.13
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.13 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

95d06ad96a7d087d33812be81fcf55efc516a171cbcd3ede8333eb35c01983f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: blog.cobaltstrike.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Tue, 01 Sep 2020 14:09:04 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
link: <https://wp.me/1Wz51>; rel=shortlink
content-encoding: gzip
x-ac: 1.ams _dfw

Redirect headers

Server: nginx
Date: Tue, 01 Sep 2020 14:09:04 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://blog.cobaltstrike.com/
X-ac: 5.ams _dfw

GET
H2 200 /
s0.wp.com/_static/ 217 KB
30 KB 61ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydketKAzEQhV/I7LgLxfaH+Cy5jHFqbmQm1Ly92WpLsUWLDIS5fQM5Bw5F2ZwEk0BsqoTmKTEcis1RcaSA/Uc1WeYHuI1ReqVE0s/JXcvyhhEZSjOQUMsVcwJ8G6XB6sekImynp2kG0yg4MCHbdxXIVF07sPSAd5w5Ugx7lKJXXPfcRPlK7r8nqhZKnv/Abf7GlmkEOGI599Rt9EK39fOjH4uWdSOiI41hSJiupbu0lJxHGTifciX48Tty9N2YUpFZjTdSi+rLrpV7ic/zZrd9nHfLZtl/ArBy3JU=?cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 37186f17402b2951af7f654fa0ab31afb1d22d8cac0c486683a5d57395e2d386

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
last-modified: Fri, 21 Aug 2020 14:18:13 GMT
server: nginx
etag: W/"5f3fd7a5-3633c"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Thu, 26 Aug 2021 11:53:20 GMT

GET
H2 200 /
s0.wp.com/_static/ 7 KB
2 KB 60ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx9i0EKgzAQAD/UdBFSqgfxLTGsaWSzG9wNxd+rN3vpbQZm4FtdFDZkA/tgQYXaZmAMBmo74TOqPuBWleYqtZRZIaE4khgsC/+IWyjk7d+64UySTkxwVje9pqmMnX8N3vfvzq8HqLo77Q==?cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6df81b3f46e5aa5155343447fe3d8b539c2ad287f7c028e18437661460247a05

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
last-modified: Mon, 16 May 2016 00:20:57 GMT
server: nginx
etag: W/"57391269-1c0c"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Fri, 18 Jun 2021 12:13:47 GMT

GET
H2 200 actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 12 KB
3 KB 60ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?m=1560469195h&cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4b8028d155fe4a770ade6995dd1f3009bbff5869e9c3e06953a49e9a571bb0be

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
server: nginx
etag: W/"5d02df9e-3624"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 05 May 2021 17:55:49 GMT

GET
H2 200 /
s0.wp.com/_static/ 29 KB
11 KB 60ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxti8sKgCAQAH8oW6KHdoi+xcTUWF1pjX4/OnSIOg0DM3BmYSgVmwrEQ2Q8XEgMmbiIFXXYgb3eQ3IPa8Ncwf/FZIJGgeToLZ+peBstg+/AIS0a72COU9OPUg69atV2AWWKN+I=?cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 03d1076123112f8b3de7daaabeb7e4df9147a4d20feca5597c40dd62eca16791

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 15:51:22 GMT
server: nginx
etag: W/"5f3bf8fa-72b0"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 18 Aug 2021 15:51:25 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 132 KB
42 KB 61ms
20ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b5b0039d6b49d16a58800cf527da18050dfed96bb44f57cbb5ad74a8df3bd4b2

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
last-modified: Mon, 20 May 2019 12:51:00 GMT
server: nginx
etag: W/"5ce2a2b4-20f10"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Thu, 04 Feb 2021 10:15:31 GMT

GET
H2 200 style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 19 KB
3 KB 60ms
20ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc65-5e1f"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 03 Feb 2021 04:32:42 GMT

GET
H2 200 /
s0.wp.com/ 504 B
438 B 59ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/?custom-css=1&csblog=1Wz51&cscache=6&csrev=12
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 32ab4b5deff010d850f8089a94c5f5647b321fd17804e917288f2388dccbfe1d

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
server: nginx
status: 200
vary: Accept-Encoding
content-type: text/css;charset=utf-8
x-nc: HIT ams 1
x-ac: 3.ams _dfw
expires: Thu, 04 Feb 2021 08:53:21 GMT

GET
H2 200 h1.gif
s0.wp.com/wp-content/themes/pub/neat/images/ 87 B
191 B 19ms
18ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/themes/pub/neat/images/h1.gif
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f028276e931c787fb9ecfd7f03e750743134cf2acdc2fc23a6d35f4161bbd83e

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
x-ac: 3.ams _dfw
last-modified: Sat, 31 Dec 2016 05:33:22 GMT
server: nginx
etag: "58674322-57"
content-type: image/gif
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 87
expires: Wed, 03 Feb 2021 05:23:05 GMT

GET
H2 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 14 KB
5 KB 19ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1596548281h&ver=5.5-wpcom-48929
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
server: nginx
etag: W/"5f2964cb-37a6"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 01 Sep 2021 13:03:51 GMT

GET
H2 200 global-print.css
s0.wp.com/wp-content/mu-plugins/global-print/ 5 KB
2 KB 19ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/global-print/global-print.css?m=1465851035h&cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:04 GMT
content-encoding: gzip
server: nginx
etag: W/"58674300-1f6c"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 03 Feb 2021 04:32:42 GMT

GET
H2 200 gfYswA_Ronw
www.youtube.com/embed/ Frame AA4B 0
0 86ms
85ms Document
text/html 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/gfYswA_Ronw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/gfYswA_Ronw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
content-length: 10601
content-encoding: br
date: Tue, 01 Sep 2020 14:09:04 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; path=/; domain=.youtube.com; secure; expires=Sun, 28-Feb-2021 14:09:04 GMT; httponly; samesite=None YSC=CjqdlFsJsgE; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT VISITOR_INFO1_LIVE=wq-ydMp2GIk; path=/; domain=.youtube.com; secure; expires=Sun, 28-Feb-2021 14:09:04 GMT; httponly; samesite=None
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 body-bg.jpg
rsmudge.files.wordpress.com/2012/06/ 190 KB
191 KB 87ms
35ms Image
image/jpeg 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2012/06/body-bg.jpg

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

afecd5e18467063cc3502c0a8b08cf9784eed95003b218e134e7b64f6b79328d

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 16 Jun 2012 17:58:43 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/jpeg
access-control-allow-origin: https://rsmudge.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 194715
expires: Wed, 23 Sep 2020 21:31:56 GMT

GET
H2 200 header21.png
rsmudge.files.wordpress.com/2012/06/ 2 KB
2 KB 88ms
37ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2012/06/header21.png

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/?custom-css=1&csblog=1Wz51&cscache=6&csrev=12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1f5523d5e96e35c06687257f388787130bf0299761e0c3a06b45d61417439432

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://s0.wp.com/?custom-css=1&csblog=1Wz51&cscache=6&csrev=12
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Sat, 16 Jun 2012 19:57:57 GMT
server: nginx
status: 200
x-orig-src: 01_mogdir
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
access-control-allow-credentials: true
accept-ranges: bytes
vary: Origin
content-length: 2358
expires: Fri, 25 Sep 2020 22:16:41 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Origin: https://blog.cobaltstrike.com
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 screen-shot-2020-05-12-at-2.06.30-pm.png
rsmudge.files.wordpress.com/2020/05/ 65 KB
65 KB 29ms
28ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2020/05/screen-shot-2020-05-12-at-2.06.30-pm.png?w=650

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c98a9a0e5fe87e3030b2540add41fd92f50b3f24a7b67733cb8fda61c1d204a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Tue, 12 May 2020 20:41:28 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 66892
expires: Thu, 24 Sep 2020 02:21:32 GMT

GET
H2 200 consolidate.png
rsmudge.files.wordpress.com/2019/12/ 89 KB
89 KB 29ms
29ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2019/12/consolidate.png?w=700

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

cb26576d78adb5449c63d0db0859fb96adbd39e61098a702db7475651b318628

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 05 Dec 2019 18:46:40 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 91281
expires: Mon, 21 Sep 2020 22:25:15 GMT

GET
H3-Q050 200 0AOQqd6OQzk
www.youtube.com/embed/ Frame F0A7 0
0 160ms
141ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/0AOQqd6OQzk?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/0AOQqd6OQzk?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
cache-control: no-cache
x-content-type-options: nosniff
content-length: 10588
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 QlotGFMuRBA
www.youtube.com/embed/ Frame 193E 0
0 111ms
96ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/QlotGFMuRBA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/QlotGFMuRBA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-length: 10601
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control: no-cache
content-type: text/html; charset=utf-8
content-encoding: br
expires: Tue, 27 Apr 1971 19:44:06 GMT
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 dNC5HKwmbyI
www.youtube.com/embed/ Frame 2F94 0
0 156ms
142ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/dNC5HKwmbyI?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/dNC5HKwmbyI?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-length: 10672
x-content-type-options: nosniff
content-type: text/html; charset=utf-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding: br
strict-transport-security: max-age=31536000
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 yTIeeMVetfw
www.youtube.com/embed/ Frame BB0C 0
0 106ms
92ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/yTIeeMVetfw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/yTIeeMVetfw?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
x-content-type-options: nosniff
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-length: 10672
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 videoseries
www.youtube.com/embed/ Frame 55CA 0
0 110ms
97ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/videoseries?list=PL9HO6M_MU2nfQ4kHSCzAQMqxQxH47d1no&hl=en_US

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/videoseries?list=PL9HO6M_MU2nfQ4kHSCzAQMqxQxH47d1no&hl=en_US
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache
content-encoding: br
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 10692
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 35kUS6WQm84
www.youtube.com/embed/ Frame F46B 0
0 107ms
96ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/35kUS6WQm84?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/35kUS6WQm84?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-length: 10577
content-encoding: br
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
cache-control: no-cache
content-type: text/html; charset=utf-8
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 processbrowser314.png
www.cobaltstrike.com/images/ 137 KB
137 KB 169ms
128ms Image
image/png 2606:4700:10::6814:aa2e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cobaltstrike.com/images/processbrowser314.png
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:aa2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ee30fb24a222a33491836b693cb486c4a94f8d0dbba46df9b09fbc563130e8a

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
cf-cache-status: HIT
status: 200
content-length: 139915
cf-request-id: 04eb990bb10000d6fd6c92d200000001
content-range: 0-139914/139915
cf-bgj: h2pri
server: cloudflare
etag: "16a70333020"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5cbf9125e910d6fd-FRA
expires: Sat, 09 Nov 2019 01:36:46 GMT

GET
H2 200 filebrowser314.png
www.cobaltstrike.com/images/ 120 KB
121 KB 163ms
122ms Image
image/png 2606:4700:10::6814:aa2e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cobaltstrike.com/images/filebrowser314.png
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:aa2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81bd1f252888d06fe9e3739556402e759ac2b7d30680287e4f31006fe1620e94

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
cf-cache-status: HIT
server: cloudflare
status: 200
etag: "16a70332080"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
content-range: 0-123105/123106
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5cbf9125e912d6fd-FRA
content-length: 123106
cf-request-id: 04eb990bb10000d6fd6c92e200000001
expires: Tue, 11 Aug 2020 12:45:48 GMT

GET
H2 200 analysis.png
rsmudge.files.wordpress.com/2019/02/ 74 KB
74 KB 28ms
24ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2019/02/analysis.png?w=600

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2e84873095a59d332bb341bfea3582517c565831608746738ef0ba2f33b2b817

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Tue, 19 Feb 2019 18:44:22 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 75927
expires: Sat, 12 Sep 2020 23:02:20 GMT

GET
H2 200 certsearch.png
rsmudge.files.wordpress.com/2019/02/ 69 KB
69 KB 27ms
24ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2019/02/certsearch.png?w=600

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

32345ba1311e98303fc07f4db8949ac782a1d99e262e70a7baa443db3cae4d59

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Tue, 19 Feb 2019 18:45:34 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 70695
expires: Sun, 06 Sep 2020 19:40:27 GMT

GET
H2 200 sshpivot.png
rsmudge.files.wordpress.com/2018/12/ 45 KB
45 KB 31ms
29ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rsmudge.files.wordpress.com/2018/12/sshpivot.png?w=600

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c3ec9e839f406d477ca4a81339ce97926d9bd0b9b75bc09570b1ba480187b630

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff, nosniff

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 27 np
date: Tue, 01 Sep 2020 14:09:04 GMT
x-content-type-options: nosniff, nosniff, nosniff
last-modified: Thu, 27 Dec 2018 21:56:03 GMT
server: nginx
status: 200
accept-ranges: bytes
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://rsmudge.wordpress.com
x-orig-src: 0_imageresize
access-control-allow-credentials: true
content-length: 46193
expires: Fri, 11 Sep 2020 20:23:17 GMT

GET
H3-Q050 200 jNqgMvlxyfM
www.youtube.com/embed/ Frame A196 0
0 98ms
97ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/jNqgMvlxyfM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/jNqgMvlxyfM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-type: text/html; charset=utf-8
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
expires: Tue, 27 Apr 1971 19:44:06 GMT
strict-transport-security: max-age=31536000
cache-control: no-cache
content-length: 10617
x-content-type-options: nosniff
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 1-3JAkuZNd0
www.youtube.com/embed/ Frame C2B6 0
0 98ms
97ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/1-3JAkuZNd0?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/1-3JAkuZNd0?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
cache-control: no-cache
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
content-encoding: br
content-length: 10729
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 mS7rBne3CRA
www.youtube.com/embed/ Frame 3A10 0
0 92ms
91ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/mS7rBne3CRA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/mS7rBne3CRA?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
content-length: 10708
x-content-type-options: nosniff
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:04 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 lu363dcAslU
www.youtube.com/embed/ Frame BAB2 0
0 100ms
98ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/lu363dcAslU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/lu363dcAslU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
x-content-type-options: nosniff
content-length: 10609
strict-transport-security: max-age=31536000
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:05 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 gprofiles.js Show response
0.gravatar.com/js/ 23 KB
7 KB 88ms
5ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=202036y
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 15:50:36 GMT
server: nginx
etag: W/"5e8609cc-5dea"
content-type: application/javascript
status: 200
cache-control: max-age=604800
expires: Tue, 08 Sep 2020 14:09:05 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 582 B
411 B 24ms
20ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
server: nginx
etag: W/"58674607-2f0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 03 Feb 2021 04:32:43 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 42 KB
11 KB 24ms
21ms Script
application/x-javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1573483029j
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Mon, 11 Nov 2019 14:37:22 GMT
server: nginx
etag: W/"5dc97222-a830"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Tue, 10 Nov 2020 14:37:25 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 33 KB
13 KB 64ms
62ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKioFmldQQE3jAlKLcoDm2efaGpqaGxgZmFhamGYBABUkXyQ=
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c8193529d08fed869e69c53d756192d00813f291801366729d5484f6eae24ce1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Fri, 04 Oct 2019 16:03:14 GMT
server: nginx
etag: W/"5d976d42-83c7"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Thu, 29 Jul 2021 01:27:43 GMT

GET
H2 200 /
s0.wp.com/_static/ 24 KB
4 KB 23ms
21ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/mu-plugins/carousel/jetpack-carousel.css,/wp-content/mu-plugins/tiled-gallery/tiled-gallery.css?m=1592560282j&cssminify=yes
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 24a41338d2c44362b387fae3df157c338e8cf0930349a83e6d81eea0369d6cf5

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Fri, 19 Jun 2020 09:51:32 GMT
server: nginx
etag: W/"5eec8aa4-605c"
vary: Accept-Encoding
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Sat, 19 Jun 2021 09:51:36 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 182 KB
49 KB 23ms
21ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyVj0luwzAMRS9UlShiL7IIehZGpl2qsiSQtJPcvkoAZ1oI6Iqfw/sk4VScz8koGQSFgVb2VM6fQT/gqTUvrsRl4qTAaeTEdrmLxiwOMyd3RIEZ1UiqcnklER5IH7V/Opig/9UW5I1zukJ3tU1z8nG5Lq/P6mnMx0De3q02n7WemQFVyW7ALS9C2lruUfKiFCGQlXqo2woNxjjS4CaMkeTymjWoktXcGJEF9AeF07TFCn3Ph69+3++6Xdd34Q8uV7co
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: eb8210d4ad4944cfecc6155f2de7a4c08e5f73c92727c7477cac976e093d55ef

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Tue, 21 Jul 2020 14:57:47 GMT
server: nginx
etag: W/"5f17026b-2d8a0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 21 Jul 2021 16:34:44 GMT

GET
H2 200 w.js Show response
stats.wp.com/ 13 KB
5 KB 157ms
74ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?61
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
server: nginx
etag: W/"5e6029bb-4e62"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Thu, 04 Mar 2021 22:24:11 GMT

GET
H3-Q050 200 AV4XjxYe4GM
www.youtube.com/embed/ Frame 91FE 0
0 150ms
86ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/AV4XjxYe4GM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/AV4XjxYe4GM?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-type: text/html; charset=utf-8
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-length: 10681
cache-control: no-cache
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
content-encoding: br
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:05 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 fDs9av_pBaU
www.youtube.com/embed/ Frame ED40 0
0 141ms
79ms Document
text/html 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/fDs9av_pBaU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/fDs9av_pBaU?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=wq-ydMp2GIk; YSC=CjqdlFsJsgE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-type: text/html; charset=utf-8
content-encoding: br
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-length: 10720
x-content-type-options: nosniff
date: Tue, 01 Sep 2020 14:09:05 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Tue, 01-Sep-2020 14:39:05 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 19ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc5b-1995"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 03 Feb 2021 04:36:44 GMT

GET
H2 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
510 B 19ms
19ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&ver=3.0.9b
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
server: nginx
etag: W/"5c32dc5b-b3d"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
x-ac: 3.ams _dfw
expires: Wed, 03 Feb 2021 04:36:44 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 45ms
44ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Tue, 01 Sep 2020 14:09:05 GMT
x-ac: 3.ams _dfw
last-modified: Mon, 07 Jan 2019 04:58:00 GMT
server: nginx
etag: "5c32dc58-200b"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 8203
expires: Wed, 03 Feb 2021 04:32:50 GMT

GET
H2 200 hovercard.min.css
0.gravatar.com/dist/css/ 8 KB
2 KB 10ms
7ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/hovercard.min.css?ver=202036y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202036y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ba4824bef4054dec92055cf62207b9532823232c0d58f9c31c1213b2eb333ff9

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Tue, 24 Mar 2020 12:26:59 GMT
server: nginx
etag: W/"5e79fc93-1fb3"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Tue, 08 Sep 2020 14:09:05 GMT

GET
H2 200 services.min.css
0.gravatar.com/dist/css/ 3 KB
587 B 10ms
8ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/services.min.css?ver=202036y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202036y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 01 Sep 2020 14:09:05 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Tue, 08 Sep 2020 14:09:05 GMT

GET
H2 200 / Show response
graph.facebook.com/ 236 B
325 B 170ms
79ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2020%2F06%2F25%2Fcobalt-strike-4-1-the-mark-of-injection%2F&_=1598969344786

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ea372c5e525752d344b32ec6ad86faec878d30bbce881ab80c4349a9d69b3f07

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "f16e9a0cd229af636ab73c9a4b0f59126e6a48fc"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 137
pragma: no-cache
x-fb-debug: iRP7LCNxvS8HLxvOdXRzGZKh7Ssv4TDZKehoLTLGdtrxRE1oJTlNCaMwtnRy7cen//OjuPH+kFSmZsYT8I0xmg==
x-fb-trace-id: EYldqJBwCkJ
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AJfZrYEXthxg9CSdLyW2lAZ
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 236 B
316 B 171ms
83ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2020%2F05%2F12%2Fssl-certificate-verification-for-failed%2F&_=1598969344787

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

19a38a0cb5e1d23fa767bde89103d3972524c8717b79e21763abc74aafb3d349

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "71000ca6f2e5939e977747b9c354dccc58abb613"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 130
pragma: no-cache
x-fb-debug: DC/TBQO+h/nmtUnmefXKqnm+T/jZ8UiTPwtQ8fukUT756h6ehVLDS/Ql0MsHKhPTO8oy829DhFZzEvR/DLvQfQ==
x-fb-trace-id: GC2aetmu0Er
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AlJCvJvx9TsMEIf2eKKs3JH
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 258 B
330 B 168ms
81ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2020%2F03%2F04%2Fcobalt-strike-joins-core-impact-at-helpsystems-llc%2F&_=1598969344788

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0831e6cf10ad59c6a6b168de33cf033be16497e44e6ddb129f075ad86dc70567

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "24e3b602c826fe57ddbf6ef5d3ac676a3fa7fe97"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 144
pragma: no-cache
x-fb-debug: CpgIUnP+Pyft1uVclusLxMya58Dl1e/AcHHYkpfiaG//1TAjNB3FArh06A39XgGCIva82f5vAUNrgwWd6wYWBg==
x-fb-trace-id: D+O6VDZwD3+
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: Am_2-cfmK20eC6NBZWpQkyU
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 250 B
329 B 176ms
89ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F12%2F05%2Fcobalt-strike-4-0-bring-your-own-weaponization%2F&_=1598969344789

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4f43dd1c1411ba3a7d3177a24ba3e836729d3d198f768cb53c4346e424f33159

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "1f750bf27ab44d7c1e7dfe58a7a6ca728463ec25"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 143
pragma: no-cache
x-fb-debug: 5QG6iDZY7ywTBOv8lSU3UxamFtKAGT4pwbRZLl8/dX2hstUtOVjJntbbO4uOXZiSinbCg4pu7hEY9SuMcjLcMQ==
x-fb-trace-id: Hy1ovxdd3M3
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AOXpB6X4XaFjNAu8cM4mvbm
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 246 B
576 B 162ms
78ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F08%2F21%2Fcobalt-strikes-process-injection-the-details%2F&_=1598969344790

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0aedf1abf40330522bb1c73b43e1261da4bb71aadbe5edab3c79bd7ae0666762

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "4e41fa4baaa62edf1df7afc49f77eafba0a1ed1f"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 138
pragma: no-cache
x-fb-debug: 4SedocZG/zYmUrkhmLsRs09aDW3NYcvvwXIo6JMG/1IaYVCPGNxWooxtR5Vr5Yuu1X3mMCjZbSNO6mwyjIk5Ig==
x-fb-trace-id: Bt4aroy0KsC
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AloeN-Eui5k1FLBCOTyUexr
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 250 B
325 B 166ms
82ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F06%2F21%2Fthat-time-a-printer-tried-to-get-cobalt-strike%2F&_=1598969344791

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

07d1339dc52de6b2ca80fb31d50d1f909227aec69a76cf30bce67173d05ea68c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "1dca175d7cc6db84b5c6644dbdd9613772f71fbe"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 140
pragma: no-cache
x-fb-debug: bVtOQdgTVZQUt4CJhkqFak0Ykk0wVar/gaQj7kNIC4rJJBH6NFVKrTdQX8E29vlIN0Pg6t/qi8Ee3P8VuRE6TA==
x-fb-trace-id: DaNj7Utu6DR
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AoN3eGrbnZ3h1MZtLo2bZ_z
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 242 B
325 B 90ms
1ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F05%2F02%2Fcobalt-strike-3-14-post-ex-omakase-shimasu%2F&_=1598969344792

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

66f4d88146f0b41a327b47edbc68a4af902340d58991abce51577b0fa7e8d3e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "f58e3ea529fa8cb2ce85648ee7475348ebc81aa2"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 139
pragma: no-cache
x-fb-debug: Wogi+4y3AUMmnqFIEi0DNXP2vAqSEQzrhHaQoAG/JlMyLaFm6lfCbbr87SKqmOckmz13nIsAcxVJE5dYsz0cMw==
x-fb-trace-id: CCS7VNNPEjf
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AaciTl5Sg3jxgu1wKxMl9f_
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 242 B
326 B 88ms
0ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F02%2F19%2Fcobalt-strike-team-server-population-study%2F&_=1598969344793

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a206fd4e5108e8177af1fcef05b4f853e317d3b190afad16b1f92ab00cba9293

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "118bf066ec38e3d2cdc890cbe59771b74629a940"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 139
pragma: no-cache
x-fb-debug: RHtDbXULhqwzyQohRGSmn6T80vy+JZmqacf3l+/Asi3VobWQpLzZ56BdoJaVM75k/GTH8CjfHGYJpcyC58Oxvg==
x-fb-trace-id: AAajRpLkOTO
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AFNo_sXOY2X9e8YkkXamyIF
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 226 B
319 B 87ms
0ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2019%2F01%2F02%2Fcobalt-strike-3-13-why-do-we-argue%2F&_=1598969344794

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

71ee3d2f2adb7172ebf050c652390b05d383868a3bc6c3304840604ebe803991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "058cdce409c0f12bbe8635ce947434ea1040f383"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 134
pragma: no-cache
x-fb-debug: p8m/x/AEv/0NEHQWenqfxH1VVS9Op3Ffux2+6m9O3M4LoQt5YJww6MS1VAoeHfedaYeVRuM0Iw15P3iA046HBQ==
x-fb-trace-id: HDw7fAeqOEa
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AIT_kqzAi9iE9SuhSG1Zvqd
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 242 B
326 B 87ms
0ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fblog.cobaltstrike.com%2F2018%2F09%2F06%2Fcobalt-strike-3-12-blink-and-youll-miss-it%2F&_=1598969344795

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-includes/js/jquery/jquery.js,/wp-content/js/postmessage.js,/wp-content/js/mobile-useragent-info.js?m=1558356653j

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

469c912dcbc0e52e7ecc93365210ce2a3a0a80c324b9dc7c74f074e6bc2d2f8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
etag: "74244d26e9c402ac9c67edae5faecd9f3e76d543"
status: 200
x-fb-rev: 1002600685
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 139
pragma: no-cache
x-fb-debug: yFdcKUVkPGOiWQFKmiLtZO0aW1OpX+4MxOtRMp/iq09znWJ01E/RQPDuBp414c93gj3+BT4xIGwmeiDfU8bkTA==
x-fb-trace-id: CTnpCSaFEuE
date: Tue, 01 Sep 2020 14:09:05 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AFpo83myyVNIa5_WbDG6TJx
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 33ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.049533880725061596
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 32ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.38849254854549686
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 31ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.2983937429849013
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 97ms
85ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.22276986672809018
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 117ms
21ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.7344404204641908
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 119ms
23ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.4684972702163388
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 119ms
24ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.7906774289487373
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 125ms
25ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.016881671655457176
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 125ms
26ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.23028683141451367
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 129ms
30ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.9034100593484484
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 remote-login.php
r-login.wordpress.com/ Frame 2C51 0
0 370ms
186ms Document
text/html 192.0.78.18
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9ibG9nLmNvYmFsdHN0cmlrZS5jb20%3D&wpcomid=28734211&time=1598969344

Requested by

Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.18 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: r-login.wordpress.com
:scheme: https
:path: /remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9ibG9nLmNvYmFsdHN0cmlrZS5jb20%3D&wpcomid=28734211&time=1598969344
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blog.cobaltstrike.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://blog.cobaltstrike.com/

Response headers

status: 200
server: nginx
date: Tue, 01 Sep 2020 14:09:05 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Cookie
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: gzip
x-ac: 2.ams _dfw
strict-transport-security: max-age=15552000

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 79ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.04302607043494122
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 80ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=28734211&v=wpcom&tz=-4&user_id=0&subd=rsmudge&host=blog.cobaltstrike.com&ref=&fcp=645&rand=0.6916662889259193
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 80ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29%2BSmw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8%2FMkNtblkvY1cybz0zLi4sa1YmNl8vOHk1JjhadWtvMCYyS0JLQnJuZHQ2dH5fREpvWk5ELWl6YXo2elRvOVR0R35%2BZWItP1RRJlhKUnRzbXF1RS8%2Fd3hYWDJrUGpsTi5WOS1yMFd0TEh1aG5wMkt3cl1bYlFtYWRwd1FBeXlFaE1Ca35oeiZqYVRiPzYrMDBlZ18vXS0zVFYtR2dUb1VjWXhbT3A3Zmt2SGd2fiwmS1FwYUZZfCstLHFtYVhqa1R5aldORFhpJV04Jk1KX0ZpL0lFX2RdeWZNaEFdODRWKzIuXzI3Ug%3D%3D&v=wpcom-no-pv&rand=0.5999027655956044
Requested by: Host: blog.cobaltstrike.com
URL: https://blog.cobaltstrike.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://blog.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 01 Sep 2020 14:09:05 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1970-01-19 16:28:41	Name: VISITOR_INFO1_LIVE Value: wq-ydMp2GIk
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: CjqdlFsJsgE
.cobaltstrike.com/	1970-01-19 12:52:41	Name: __cfduid Value: d68a53027d5fa943feddf5021c37fc96c1598969344

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
blog.cobaltstrike.com
graph.facebook.com
pixel.wp.com
r-login.wordpress.com
rsmudge.files.wordpress.com
s0.wp.com
stats.wp.com
www.cobaltstrike.com
www.youtube.com
192.0.72.27
192.0.76.3
192.0.77.32
192.0.78.13
192.0.78.18
2606:4700:10::6814:aa2e
2a00:1450:4001:801::200e
2a00:1450:4001:802::200e
2a03:2880:f01c:800e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
03d1076123112f8b3de7daaabeb7e4df9147a4d20feca5597c40dd62eca16791
07d1339dc52de6b2ca80fb31d50d1f909227aec69a76cf30bce67173d05ea68c
0831e6cf10ad59c6a6b168de33cf033be16497e44e6ddb129f075ad86dc70567
0aedf1abf40330522bb1c73b43e1261da4bb71aadbe5edab3c79bd7ae0666762
19a38a0cb5e1d23fa767bde89103d3972524c8717b79e21763abc74aafb3d349
1f5523d5e96e35c06687257f388787130bf0299761e0c3a06b45d61417439432
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb
24a41338d2c44362b387fae3df157c338e8cf0930349a83e6d81eea0369d6cf5
2e84873095a59d332bb341bfea3582517c565831608746738ef0ba2f33b2b817
32345ba1311e98303fc07f4db8949ac782a1d99e262e70a7baa443db3cae4d59
32ab4b5deff010d850f8089a94c5f5647b321fd17804e917288f2388dccbfe1d
37186f17402b2951af7f654fa0ab31afb1d22d8cac0c486683a5d57395e2d386
3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2
469c912dcbc0e52e7ecc93365210ce2a3a0a80c324b9dc7c74f074e6bc2d2f8b
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558
4b8028d155fe4a770ade6995dd1f3009bbff5869e9c3e06953a49e9a571bb0be
4f43dd1c1411ba3a7d3177a24ba3e836729d3d198f768cb53c4346e424f33159
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0
5ee30fb24a222a33491836b693cb486c4a94f8d0dbba46df9b09fbc563130e8a
66f4d88146f0b41a327b47edbc68a4af902340d58991abce51577b0fa7e8d3e1
6df81b3f46e5aa5155343447fe3d8b539c2ad287f7c028e18437661460247a05
71ee3d2f2adb7172ebf050c652390b05d383868a3bc6c3304840604ebe803991
7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf
81bd1f252888d06fe9e3739556402e759ac2b7d30680287e4f31006fe1620e94
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
95d06ad96a7d087d33812be81fcf55efc516a171cbcd3ede8333eb35c01983f8
a206fd4e5108e8177af1fcef05b4f853e317d3b190afad16b1f92ab00cba9293
afecd5e18467063cc3502c0a8b08cf9784eed95003b218e134e7b64f6b79328d
b5b0039d6b49d16a58800cf527da18050dfed96bb44f57cbb5ad74a8df3bd4b2
ba4824bef4054dec92055cf62207b9532823232c0d58f9c31c1213b2eb333ff9
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c3ec9e839f406d477ca4a81339ce97926d9bd0b9b75bc09570b1ba480187b630
c8193529d08fed869e69c53d756192d00813f291801366729d5484f6eae24ce1
c98a9a0e5fe87e3030b2540add41fd92f50b3f24a7b67733cb8fda61c1d204a8
cb26576d78adb5449c63d0db0859fb96adbd39e61098a702db7475651b318628
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ea372c5e525752d344b32ec6ad86faec878d30bbce881ab80c4349a9d69b3f07
eb8210d4ad4944cfecc6155f2de7a4c08e5f73c92727c7477cac976e093d55ef
f028276e931c787fb9ecfd7f03e750743134cf2acdc2fc23a6d35f4161bbd83e
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f45206737eac638bb52a6adda01ec197e1b62f4e40399fbf2956497308b4b63f

blog.cobaltstrike.com Open in urlscan Pro 192.0.78.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

69 Requests

100 %HTTPS

50 %IPv6

6 Domains

10 Subdomains

11 IPs

3 Countries

1048 kBTransfer

1733 kBSize

3 Cookies

84 Outgoing links

Page URL History

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.cobaltstrike.com Open in urlscan Pro
192.0.78.13 Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

10
Subdomains

11
IPs

3
Countries

1048 kB
Transfer

1733 kB
Size

3
Cookies

69 HTTP transactions
1 data transactions