urlscan.io logo urlscan.io
SecurityTrails logo

pentestlab.blog Open in urlscan Pro
192.0.78.24  Public Scan

Go To Rescan Add Verdict Report
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Submission: On March 04 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 4 countries across 12 domains to perform 99 HTTP transactions. The main IP is 192.0.78.24, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is pentestlab.blog.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 12th 2020. Valid for: 3 months.
This is the only time pentestlab.blog was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

2    192.0.78.24 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
pentestlab.blog
37    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s1.wp.com
s0.wp.com
s2.wp.com
widgets.wp.com
30    192.0.72.28 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
pentestlab.files.wordpress.com
4    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
1.gravatar.com
0.gravatar.com
3    2a00:1450:4001:81f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
4    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
4    192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com
polldaddy.com
6    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
1    2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
1    2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    23.210.248.189 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-189.deploy.static.akamaitechnologies.com
api.pinterest.com
1    2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)
graph.facebook.com
1    192.0.78.18 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
r-login.wordpress.com
1    104.244.42.200 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
Domain Requested by
30 pentestlab.files.wordpress.com pentestlab.blog
23 s1.wp.com pentestlab.blog
7 s0.wp.com pentestlab.blog
5 pixel.wp.com pentestlab.blog
5 s2.wp.com pentestlab.blog
4 polldaddy.com pentestlab.blog
polldaddy.com
platform.twitter.com
4 platform.twitter.com pentestlab.blog
platform.twitter.com
3 www.google.com pentestlab.blog
www.gstatic.com
3 0.gravatar.com pentestlab.blog
s0.wp.com
2 widgets.wp.com pentestlab.blog
s0.wp.com
2 connect.facebook.net s0.wp.com
connect.facebook.net
2 pentestlab.blog s0.wp.com
1 syndication.twitter.com pentestlab.blog
1 r-login.wordpress.com pentestlab.blog
1 graph.facebook.com s0.wp.com
1 api.pinterest.com s0.wp.com
1 www.facebook.com connect.facebook.net
1 www.gstatic.com www.google.com
1 www.youtube.com pentestlab.blog
1 stats.wp.com pentestlab.blog
1 1.gravatar.com pentestlab.blog
99 21
Subject Issuer Validity Valid
tls.automattic.com
Let's Encrypt Authority X3		 2020-02-12 -
2020-05-12		 3 months crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2		 2018-04-10 -
2020-05-11		 2 years crt.sh
*.files.wordpress.com
Sectigo RSA Domain Validation Secure Server CA		 2019-01-15 -
2021-01-14		 2 years crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
www.google.com
GTS CA 1O1		 2020-02-12 -
2020-05-06		 3 months crt.sh
*.twimg.com
DigiCert SHA2 High Assurance Server CA		 2019-11-12 -
2020-11-18		 a year crt.sh
*.polldaddy.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
*.google.com
GTS CA 1O1		 2020-02-12 -
2020-05-06		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-01-16 -
2020-04-15		 3 months crt.sh
*.pinterest.com
DigiCert SHA2 High Assurance Server CA		 2019-06-05 -
2020-07-22		 a year crt.sh
*.wordpress.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
syndication.twitter.com
DigiCert SHA2 High Assurance Server CA		 2019-04-09 -
2020-04-01		 a year crt.sh

This page contains 10 frames:

Primary Page: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Frame ID: 8D9528014B8D9F28E928C7EE5801E2C1
Requests: 91 HTTP requests in this frame

Frame: https://www.youtube.com/embed/MqLTUZBEliE?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Frame ID: 9A785D91E059C112ABF5504F9A219EFA
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D45%23cb%3Df19b998c484abc4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3d9f344e3cba0c%26relation%3Dparent.parent&container_width=270&height=432&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&tabs=false&width=200
Frame ID: 85D0A07CC322AACD2FF9EBED7569BD34
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20190321
Frame ID: 9D0C55571C024C596EDD324E39C07155
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.7aeb03ce9f308997020e5998720fbbf7.html?origin=https%3A%2F%2Fpentestlab.blog
Frame ID: 5D188243562482F3741D16BC4413E78A
Requests: 1 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1583298009
Frame ID: E0E7DB0AB394E167C87BCE2CC3955966
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=v1QHzzN92WdopzN_oD7bUO2P&theme=light&size=normal&cb=bys9jh2s2di6
Frame ID: CBC3B5A83A8C34011371A148E9384E03
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.7aeb03ce9f308997020e5998720fbbf7.en.html
Frame ID: 656F931D2E95E83860871C010B646AD9
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/index.html?ver=20190321
Frame ID: 55C5CAC454C7D47C3B13E3B1C2DB08E7
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=v1QHzzN92WdopzN_oD7bUO2P&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=whe7h7bwi3p7
Frame ID: F8E02263148AACB576386EC8D13779AC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Page Statistics

99
Requests

100 %
HTTPS

50 %
IPv6

12
Domains

21
Subdomains

17
IPs

4
Countries

7070 kB
Transfer

8324 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

99 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pentestlab.blog/2020/03/02/phishing-windows-credentials/ 		134 KB
28 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
73c00c95fa68df5ee67dfddb73b46ad6e4eba7a7c9724e598d60e5a165f3baa1
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

:method
GET
:authority
pentestlab.blog
:scheme
https
:path
/2020/03/02/phishing-windows-credentials/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
server
nginx
date
Wed, 04 Mar 2020 05:00:29 GMT
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=86400
vary
Accept-Encoding Cookie
last-modified
Wed, 04 Mar 2020 05:00:09 GMT
cache-control
max-age=280, must-revalidate
x-nananana
Batcache
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
x-pingback
https://pentestlab.blog/xmlrpc.php
link
<https://wp.me/p2cWvm-7cH>; rel=shortlink
content-encoding
gzip
x-ac
3.ams _dfw
/
s1.wp.com/_static/ 		173 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
5ca5fe1659efcc3418bbf59c33c8fae29c724592e10f4846f9e88cb29259742d

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Mon, 02 Mar 2020 22:49:07 GMT
server
nginx
etag
W/"5e5d8d63-2b58d"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Tue, 02 Mar 2021 23:05:32 GMT
/
s0.wp.com/_static/ 		57 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJx9T9FuwjAM/KFlptCx8TDxLUlw06xuXNWugL/H1ToNBOqT76S78x2cBxe5KBaFfnIDTSkXgXM+JVSBxkcMzJ2j3Bm4gOiV8D2KvMFrZ0J2xNFr5vJAXEM+j2vWEQNxMpjAVHd0zeTjHB78+I+e5H/aZiJykhUdnrJa8JIC9edms6/3B0jEwZtmXik21ppHCORLt9ZhYNHfeSCtH+cBy11zCcdsv2wjP5Ink7bYW522XvrNgmP/XX18bQ+7qt5WPzf0w6kj?cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
130b50172d3c5db225f95db57d61ffc9b0d3ad153a4cfebf2ba78657b63622b0

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Fri, 28 Feb 2020 23:10:46 GMT
server
nginx
etag
W/"5e599df6-e200"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Sat, 27 Feb 2021 23:10:56 GMT
/
s0.wp.com/_static/ 		161 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
32ccb9c72f3092d48c74e4fb27216eae46f8588aaa6bdb6acb2c5b8902ecce09

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Thu, 24 Oct 2019 09:01:33 GMT
server
nginx
etag
W/"5db1686d-284c1"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Fri, 23 Oct 2020 09:01:37 GMT
style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 		19 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5c32dc65-5e1f"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 04:32:42 GMT
wp-emoji-release.min.js
s1.wp.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1582709031h&ver=5.4-beta3-47400
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5e563936-364d"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Mar 2021 12:37:26 GMT
print.css
s1.wp.com/wp-content/themes/pub/notepad/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/css/print.css?m=1271364477h&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b98f6ea3b17dd46177f43acc79deb510787da7799ebf5ce7bb72d3bc9928f343

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"58674338-109f"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 05:04:14 GMT
input-prompt-fakelogonscreen.png
pentestlab.files.wordpress.com/2020/02/ 		119 KB
120 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
8d13ae92ee8e79364a4e3a5eb49b6eecee7b5886faece5c207ca03461af6c36b

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:22:46 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
122343
expires
Mon, 06 Apr 2020 06:16:12 GMT
input-prompt-fakelogonscreen-windows.png
pentestlab.files.wordpress.com/2020/02/ 		828 KB
829 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-windows.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cba32f71b1e21bb69ee0e7a94b68b7c63c95957fbd1a561c19eb9fe0f5e9c2da

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:25:20 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
847939
expires
Thu, 09 Apr 2020 14:23:55 GMT
input-prompt-fakelogonscreen-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2b9e020056bd63eec5d5905d220780d2036ec776595cdf83eef9de3cb191366f

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:27:20 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
74910
expires
Sat, 28 Mar 2020 21:44:34 GMT
input-prompt-fakelogonscreen-credentials-stored.png
pentestlab.files.wordpress.com/2020/02/ 		139 KB
139 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-fakelogonscreen-credentials-stored.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
3b5803d4f600ba6f07f7d802daeae542dbde291aa3b1d170954ef7f5ac569563

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:28:56 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
141919
expires
Thu, 26 Mar 2020 13:00:42 GMT
input-prompt-sharplocker-lock-screen.png
pentestlab.files.wordpress.com/2020/02/ 		791 KB
792 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-sharplocker-lock-screen.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f70105713f94f1ba576cdc834e7a22897caa254a1b274a2a4dc7bee2ae9030da

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 10:48:23 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
809609
expires
Tue, 07 Apr 2020 11:19:01 GMT
input-prompt-sharplocker.png
pentestlab.files.wordpress.com/2020/02/ 		165 KB
165 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-sharplocker.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7cc264e349679f450869ba46c806ba0dbf5a525bf9eb388433ecf05bd8d06093

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 10:49:51 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
168836
expires
Mon, 06 Apr 2020 06:18:42 GMT
input-prompt-credsleaker-http.png
pentestlab.files.wordpress.com/2020/03/ 		133 KB
134 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/03/input-prompt-credsleaker-http.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4e3c26b195de4359f1bf3711f15b4858015b006556c8e2af5c6df627a0959f7d

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sun, 01 Mar 2020 09:56:48 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
136592
expires
Sun, 29 Mar 2020 17:06:15 GMT
input-prompt-credsleaker-screen.png
pentestlab.files.wordpress.com/2020/02/ 		121 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-credsleaker-screen.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a17e2f9f05d01c0bbbe018eaa6bb91113a5b253e3f0de4719969dc936f9d5e49

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 12:53:55 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
123849
expires
Sun, 05 Apr 2020 21:36:15 GMT
input-prompt-credsleaker-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		63 KB
63 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-credsleaker-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
8269e79540b61f9c52daeccf593070340da1bc8a67330476f4870f4ec7722503

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 12:55:06 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
64748
expires
Sat, 04 Apr 2020 07:58:13 GMT
input-prompt-powershell.png
pentestlab.files.wordpress.com/2020/02/ 		105 KB
106 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
6d42849613c979cbd20fa9b2bc66f99ad8dad334299252851fce918531e599fb

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 10:46:05 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
107896
expires
Mon, 30 Mar 2020 15:48:04 GMT
input-prompt-powershell-invoke-credentialsphish.png
pentestlab.files.wordpress.com/2020/02/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-invoke-credentialsphish.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
00db98b9eee1771f3cc2d7124438f103cfdf17fb4b46b3d3fa0962615d27e908

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:10:47 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
27734
expires
Mon, 30 Mar 2020 01:33:32 GMT
input-prompt-invoke-credentialsphish.png
pentestlab.files.wordpress.com/2020/02/ 		168 KB
168 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-invoke-credentialsphish.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
13dc8c8c7423088c48d88265f5c422701f44140bd5345f2a7b54ffbef19c5831

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:16:39 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
172089
expires
Sun, 05 Apr 2020 15:58:22 GMT
input-prompt-invokecredentialsphish-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-invokecredentialsphish-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
393a213ef00f9d5ec1c6a3f26f4ee9f809ff5b9d74a58c8a6419a9ac96515bf5

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:13:53 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
14386
expires
Fri, 27 Mar 2020 03:47:43 GMT
input-prompt-invoke-credentialsphish-shell.png
pentestlab.files.wordpress.com/2020/02/ 		87 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-invoke-credentialsphish-shell.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9717a8ee8bbe0c7d99fbba9bf7a74fc24ba7e9361221f54ca333ee30e54f4474

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 21:12:03 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
89106
expires
Wed, 08 Apr 2020 07:19:59 GMT
input-prompt-powershell-base64.png
pentestlab.files.wordpress.com/2020/02/ 		517 KB
518 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-base64.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
08ac71341cf5d9e4804399f091ce495533990f6088fdf4064a3c91b1294ca4dd

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 12:29:38 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
529906
expires
Thu, 09 Apr 2020 07:13:44 GMT
input-prompt-powershell-base64-login.png
pentestlab.files.wordpress.com/2020/02/ 		135 KB
135 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-powershell-base64-login.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
877a42370ac831903fd5ed13b7882111d4f69e67e7db541c18893cfa9da3e7d1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 12:34:53 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
137923
expires
Tue, 24 Mar 2020 01:54:39 GMT
input-prompt-metasploit-capture-authentication.png
pentestlab.files.wordpress.com/2020/02/ 		275 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-capture-authentication.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
bb0ad39a956ea689a5f992ce22ee39329ef342c9e18c9679904c56d7aebaf96c

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 12:33:01 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
281381
expires
Mon, 23 Mar 2020 23:12:39 GMT
input-prompt-metasploit-module.png
pentestlab.files.wordpress.com/2020/02/ 		155 KB
155 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
3922421878d5b0f7af38a59193191202c018da5e10fdcae3ef58f2abf360c6b8

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 21:56:56 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
158614
expires
Thu, 09 Apr 2020 19:54:51 GMT
input-prompt-metasploit-module-all-processes.png
pentestlab.files.wordpress.com/2020/02/ 		282 KB
282 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-all-processes.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
bec55f93f48d9f10c9899d4755533c197768f85046999c01a14ce8fc059e7393

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:14:19 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
288291
expires
Mon, 30 Mar 2020 16:32:21 GMT
input-prompt-windows-authentication-window-metasploit.png
pentestlab.files.wordpress.com/2020/02/ 		79 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-windows-authentication-window-metasploit.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
25510b668f142f8d9acf744481b110f3d2790835c0f336433aaff694610e03ab

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:04:57 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
80472
expires
Thu, 02 Apr 2020 23:54:35 GMT
input-prompt-metasploit-module-all-processes-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		270 KB
270 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-all-processes-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e6d170af18ce67bba11e319fb3abd1356b3d9bdfc299c6df50b9fe789912ba7b

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 21:54:37 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
276305
expires
Thu, 26 Mar 2020 01:22:13 GMT
input-prompt-metasploit-module-windows-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		242 KB
242 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-metasploit-module-windows-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
29532c4895317d4366fdb5033a2d0a3e41a47ac4016d9b6a08ac8b93d7e0735d

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 27 Feb 2020 22:08:51 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
247693
expires
Mon, 30 Mar 2020 20:31:53 GMT
bg-stripe.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		76 B
180 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/bg-stripe.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7c9cd4d1c41c11fc93fe07dac76018d0eba349332fbdc4bb369fc05a43f868e0

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:33:44 GMT
server
nginx
etag
"58674338-4c"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
76
expires
Wed, 03 Feb 2021 07:42:39 GMT
header.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		62 KB
62 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/header.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
efc3abc411abb4d3e6a36ec48ed34f464040c8113257130d8d02cb928b813ea3

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:56 GMT
server
nginx
etag
"57391268-f6cd"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
63181
expires
Wed, 03 Feb 2021 07:12:12 GMT
subnav-gradient.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		95 B
186 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/subnav-gradient.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b3616265edff5734701c605ba5bf8af99535bbbb45195a896c7e3e1766a211d7

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 07 Jan 2019 04:58:34 GMT
server
nginx
etag
"5c32dc7a-5f"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
95
expires
Wed, 03 Feb 2021 08:35:44 GMT
wrapper.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/wrapper.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
54e398540f0808dc9f520d08256e9e5dd8129454c0066043c450d4f8f8b5c6e5

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:46:05 GMT
server
nginx
etag
"5867461d-5c3"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1475
expires
Wed, 03 Feb 2021 07:12:11 GMT
content-dots.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		400 B
469 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/content-dots.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7671be6ce10ea5a9bc530c9e03bc6ffd6b8035da6e3a41770ea08b7493ad97ae

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:46:05 GMT
server
nginx
etag
"5867461d-190"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
400
expires
Wed, 03 Feb 2021 07:12:15 GMT
post-nav.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/post-nav.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d195906c4caeccec39277ac592c9a37a9de6145e01ba87bf0fd9048eac93f8e0

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:46:05 GMT
server
nginx
etag
"5867461d-521"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1313
expires
Wed, 03 Feb 2021 07:12:15 GMT
postdata-icons.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		940 B
986 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/postdata-icons.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
bcce0a9017530c0dc1d1a3199cfc52ba882bb66bdde7cf245054ba33775f86f0

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:56 GMT
server
nginx
etag
"57391268-3ac"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
940
expires
Wed, 03 Feb 2021 07:12:15 GMT
input-prompt-lockphish.png
pentestlab.files.wordpress.com/2020/02/ 		131 KB
131 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
007f9000b001df68175e08d662a8cedea42ce260ad3a27caf9a12bb27eea7f99

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:46:00 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
134368
expires
Mon, 06 Apr 2020 18:46:08 GMT
input-prompt-lockphish-index.png
pentestlab.files.wordpress.com/2020/02/ 		60 KB
60 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-index.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
81e13013a7ce4d80fa0abef80009e79809a890e1807a563c04ee8455637bcb27

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:48:45 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
61115
expires
Tue, 24 Mar 2020 21:06:52 GMT
input-prompt-lockphish-lock-screen.png
pentestlab.files.wordpress.com/2020/02/ 		154 KB
155 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-lock-screen.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f1d7998f35c7e1f95a3c7276ae470ea7b94e24a45f7994078bfc5a628a0f6afc

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:50:09 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
158051
expires
Tue, 24 Mar 2020 04:46:29 GMT
input-prompt-lockphish-redirection.png
pentestlab.files.wordpress.com/2020/02/ 		562 KB
562 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-redirection.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ca8af873c6dd216be263403f2fe055f46388e5531b9dc4b7942752c811feeeba

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:51:59 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
575265
expires
Sun, 05 Apr 2020 03:12:49 GMT
input-prompt-lockphish-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		146 KB
146 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-lockphish-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1ba8036645d489d08bb715521c376ca173d181f90a586d9480b182346f91f67a

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:53:41 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
149657
expires
Tue, 24 Mar 2020 15:05:38 GMT
input-prompt-outlook-binary.png
pentestlab.files.wordpress.com/2020/02/ 		139 KB
139 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook-binary.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
8e8b3a4cbef6794fbe7700bf5b561c5e28f9d21d71ee7667b3a9a27fb73e48bd

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:24:35 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
141903
expires
Fri, 10 Apr 2020 08:57:38 GMT
input-prompt-outlook.png
pentestlab.files.wordpress.com/2020/02/ 		203 KB
203 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook.png?w=1024
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
8b645b06314156c0460ada1c8d56c23656cf80fcc2482fa18d17776b6c471243

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:26:28 GMT
server
nginx
vary
Accept
content-type
image/png
status
200
x-orig-src
0_imageresize
accept-ranges
bytes
content-length
208032
expires
Wed, 08 Apr 2020 01:04:17 GMT
input-prompt-outlook-credentials.png
pentestlab.files.wordpress.com/2020/02/ 		189 KB
189 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pentestlab.files.wordpress.com/2020/02/input-prompt-outlook-credentials.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.28 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e801578e5cbc2637ac9f9762a2862e1a31061f0b0af5f30560c5d1bc52d07ac7

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 28 np
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 29 Feb 2020 11:29:03 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
193719
expires
Mon, 30 Mar 2020 23:02:00 GMT
ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
MISS lb9.dfw.gravatar.com
date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Sat, 01 Mar 2008 02:44:06 GMT
server
nginx
access-control-allow-origin
*
content-type
image/png
status
200
cache-control
max-age=300
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25&d=identicon&forcedefault=y&r=G>; rel="canonical"
content-length
1792
expires
Wed, 04 Mar 2020 05:05:30 GMT
gprofiles.js
0.gravatar.com/js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/gprofiles.js?ver=202010y
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Thu, 23 Aug 2018 15:01:14 GMT
server
nginx
etag
W/"5b7ecc3a-50bc"
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Wed, 11 Mar 2020 05:00:30 GMT
wpgroho.js
s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 		582 B
388 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1380573781h
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"58674607-2f0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 04:32:43 GMT
/
s0.wp.com/_static/ 		42 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1573483029j
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Mon, 11 Nov 2019 14:37:22 GMT
server
nginx
etag
W/"5dc97222-a830"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Tue, 10 Nov 2020 14:37:25 GMT
api.js
www.google.com/recaptcha/ 		674 B
550 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
babd2cd912a94c73f80c7ae33cfbd73db5bf4b4fe1f8437bbe7416d4585a3bac
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
447
x-xss-protection
1; mode=block
expires
Wed, 04 Mar 2020 05:00:30 GMT
loading.gif
s2.wp.com/wp-content/mu-plugins/post-flair/sharing/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s2.wp.com/wp-content/mu-plugins/post-flair/sharing/images/loading.gif
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:34 GMT
server
nginx
etag
"57391252-9e2"
content-type
image/gif
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
2530
expires
Wed, 03 Feb 2021 04:33:35 GMT
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js?ver=20111117
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/41AD) /
Resource Hash
62c8512b27ff9cbb23f96fd433e159b270bf3a75571a76b8428a4effc21effe0

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Wed, 04 Mar 2020 05:00:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 25 Feb 2020 00:16:08 GMT
Server
ECS (fcn/41AD)
Age
548
Etag
"b184acc5626add1721a10b1738df2dbe+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Cache-Control
public, max-age=1800
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
29101
/
s2.wp.com/_static/ 		28 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s2.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKiotzgjISczMo6qB+eWpRcEZqTk5QFPtc20NTc0NjAxMLC1MswAz32Jn
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
31f6f32679e3b161ac5e00a81f92df3566541e40866972decdb4a0c688d99783

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Fri, 04 Oct 2019 16:03:14 GMT
server
nginx
etag
W/"5d976d42-7195"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Sat, 03 Oct 2020 21:08:28 GMT
/
s2.wp.com/_static/ 		65 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s2.wp.com/_static/??/wp-content/plugins/gutenberg-blocks/jetpack-layout-grid/blocks/front.css,/wp-content/mu-plugins/carousel/jetpack-carousel.css?m=1576278967j&cssminify=yes
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
7f9643b7e9431350b1d76f9773ced784a3d22013dbc20b9ada4a621851de7e2b

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Fri, 13 Dec 2019 23:16:18 GMT
server
nginx
etag
W/"5df41bc2-103ab"
vary
Accept-Encoding
content-type
text/css;charset=utf-8
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Tue, 15 Dec 2020 20:41:58 GMT
/
s1.wp.com/_static/ 		240 KB
72 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/_static/??-eJydkt1OwzAMhV+INPtjsAvEo6A08YbbJA6xs7G3J0XtVE3VJLhpLPv487FVfUnKUhSIojvWDs5oIX03HT/pWSkUlXw5YWTtsQfWXwUKfJroPORJjNH64mpxACGLPkN0lIdSIn89ovdNwHjPnsDH4r1iFFDgUDCexpF697Ja7Xf7g2491SSxsKqh7ccpCJf/M6GalNpXoji6xBH8++X74tKilkIYRBmSvy6tNztdB5JMpX9UgD4aCy1RryC04B50GVepqjVZB8MCuUaKzpAzDhZuuT8SJFcn/KjJClIcmm7R0v6ccPEuXf1D8nV8mrlqYZY1mQqDny6kpsQjfz1yAFHbZjUelHKo+vfwtn5+3Ry2691m3f0AlZIQzA==
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
82efcbd4758aa64a2a3fb4e33588cc3efca988f3704dd4cd3d551925453b4afb

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Fri, 28 Feb 2020 23:10:47 GMT
server
nginx
etag
W/"5e599df7-3c1db"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Tue, 02 Mar 2021 18:00:30 GMT
rating.js
polldaddy.com/js/rating/ 		15 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://polldaddy.com/js/rating/rating.js?ver=wpcom
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Tue, 18 Feb 2020 17:20:36 GMT
server
nginx
etag
W/"5e4c1ce4-3b42"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=2592000
expires
Fri, 03 Apr 2020 05:00:30 GMT
sharing.js
s1.wp.com/wp-content/mu-plugins/post-flair/sharing/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1564557884h
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
98b36dd59d75325c3b27bd16d542933c7388c6bc21ddd66369de3f22a1344310

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5d414279-3c90"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Thu, 30 Jul 2020 07:25:48 GMT
w.js
stats.wp.com/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/w.js?60
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
050c2ca74a4941fedd88349d977d960b8ab384ebb83a3c9e4b233160476ee8f1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5cb5925e-4f31"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Wed, 15 Apr 2020 08:43:53 GMT
MqLTUZBEliE
www.youtube.com/embed/ Frame 9A78 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/MqLTUZBEliE?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/MqLTUZBEliE?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
content-encoding
br
x-content-type-options
nosniff
cache-control
no-cache
content-type
text/html; charset=utf-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
expires
Tue, 27 Apr 1971 19:44:06 GMT
strict-transport-security
max-age=31536000
date
Wed, 04 Mar 2020 05:00:30 GMT
server
YouTube Frontend Proxy
x-xss-protection
0
set-cookie
VISITOR_INFO1_LIVE=emfXG0S_imo; path=/; domain=.youtube.com; secure; expires=Mon, 31-Aug-2020 05:00:30 GMT; httponly; samesite=None VISITOR_INFO1_LIVE=emfXG0S_imo; path=/; domain=.youtube.com; secure; expires=Mon, 31-Aug-2020 05:00:30 GMT; httponly; samesite=None YSC=mUuvcXS1x3k; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Wed, 04-Mar-2020 05:30:30 GMT
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
bullet.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		169 B
215 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/bullet.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
38235774b2d0353e9d997ff3b6d8e99fc875040b83f58b7d4564e470f795c17a

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:56 GMT
server
nginx
etag
"57391268-a9"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
169
expires
Wed, 03 Feb 2021 07:12:15 GMT
cancel-reply.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		389 B
459 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/cancel-reply.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
31f4a8f2b880703f2ba202b729d886ca7aeea8248c68cc77206a8da0378e511a

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:56 GMT
server
nginx
etag
"57391268-185"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
389
expires
Wed, 03 Feb 2021 07:14:49 GMT
truncated
/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

Origin
https://pentestlab.blog
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
button-back.gif
s0.wp.com/wp-content/mu-plugins/highlander-comments/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/images/button-back.gif
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35

Request headers

Referer
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:32:48 GMT
server
nginx
etag
"58674300-4d0"
content-type
image/gif
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1232
expires
Wed, 03 Feb 2021 04:33:10 GMT
sidebar-dots.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		235 B
282 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/sidebar-dots.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
6cc05bb6202411383d2bec3ff1cfbdcf5b24692a3793178d487b1d124a51687d

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:33:44 GMT
server
nginx
etag
"58674338-eb"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
235
expires
Wed, 03 Feb 2021 07:12:15 GMT
searchform.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/searchform.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
3af8e77e152af71d8c85eab6af4a33318e01ced7475a13ceafa14df6224e7f4b

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:33:44 GMT
server
nginx
etag
"58674338-60c"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1548
expires
Wed, 03 Feb 2021 07:12:15 GMT
sidebar-list-arrow.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		181 B
228 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/sidebar-list-arrow.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b0e41b2fe7c070ac096706080bd8d34e8052f65d0efe0b4f00fd93658516a836

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 16 May 2016 00:20:56 GMT
server
nginx
etag
"57391268-b5"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
181
expires
Wed, 03 Feb 2021 07:12:15 GMT
sidebar-list-circle.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		159 B
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/sidebar-list-circle.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
a64a672eac315b0dd89e27966e07dcb9b9e233bee3c3ed2985e254cf7eedf6f3

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:46:05 GMT
server
nginx
etag
"5867461d-9f"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
159
expires
Wed, 03 Feb 2021 10:47:53 GMT
blockquote.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		223 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/blockquote.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d7ab897759e1022db1b2283a364819ad6c3a8452d790b8fba91daaf1fd3f89ee

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 07 Jan 2019 04:58:34 GMT
server
nginx
etag
"5c32dc7a-df"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
223
expires
Wed, 03 Feb 2021 09:05:00 GMT
footer.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/footer.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
108f6154061a261c3c40eed6a3628d5aced38279ea1e27bb3c4a9c9aab65f8bc

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:46:05 GMT
server
nginx
etag
"5867461d-1253e"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
75070
expires
Wed, 03 Feb 2021 07:12:15 GMT
form-button-bg.png
s1.wp.com/wp-content/themes/pub/notepad/img/ 		416 B
491 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.wp.com/wp-content/themes/pub/notepad/img/form-button-bg.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
6ff610a5bce6c0bc0ff9fd95686574b871b257996382b1e7ae1426fe0c6fceab

Request headers

Referer
https://s1.wp.com/_static/??-eJylk+tuwjAMhV9oqVtgXH5Me5a0MZ0hNyUOVd9+oQENwdZN408kJ/6Oj5ITGLzonGW0DCYJr1NPNsLgO2dENKRxvKuqLsYX+B4LqCWjEt5FvqvmME1HjHBA9rI7iqmaaye7J0s8An+gyaBPLVjH6KV6wK5Mn3LZYujzSUDYVMuqhjaRVtBqN01tgwwjRB41/kFmom5My9ElFn0g9V+JIJlsH3/B90lrEYlRoKIzcLkWWG3qer1a7wBPuT9zybJygy1jnla9umQyqMni04LZVl+icXGoKDKcCIcfRTt3ubKmWtRVI6ZcFq4cVMXU9K5PWCuudNa9tXa/OxfRc8jyvvGSzx0mT5Koc1otz2Hlo7WtDxijyKuhZESJ+QP3mP6vN3k3b83rdtlsd8vF9vAJ/xdyZg==?cssminify=yes
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Sat, 31 Dec 2016 05:33:44 GMT
server
nginx
etag
"58674338-1a0"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
416
expires
Wed, 03 Feb 2021 07:12:19 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/ 		259 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8fafe784f7e1f13fccc7782f6c524a6f340b0b487b65c45aac414d09e6daded8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Mon, 02 Mar 2020 18:23:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 02 Mar 2020 05:05:22 GMT
server
sffe
age
124638
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
94503
x-xss-protection
0
expires
Tue, 02 Mar 2021 18:23:12 GMT
shCore.css
s1.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s1.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5c32dc5b-1995"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 04:36:44 GMT
shThemeDefault.css
s2.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 		2 KB
518 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s2.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&amp;ver=3.0.9b
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
etag
W/"5c32dc5b-b3d"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 04:36:44 GMT
sdk.js
connect.facebook.net/en_US/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?_=1583298030144
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9814e23b7bf865b13d090bb494af3a380dde60fd6e315dd49b1c2fdaa5e0e6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
vjFuI9gTTOjJxJGmRHas3w==
status
200
date
Wed, 04 Mar 2020 05:00:30 GMT, Wed, 04 Mar 2020 05:00:30 GMT
expires
Wed, 04 Mar 2020 05:20:30 GMT
alt-svc
h3-27=":443"; ma=3600
content-length
1780
x-fb-debug
5DatvOApwVbzfRV64mRNN8rFMhtMXNSWkNNlpVdUiXvmsAIHS7WP2uXgvYTK83MPAemvuULTTJalevqscNjD0Q==
x-fb-trip-id
1850256238
x-fb-content-md5
b7aae9c2e6818903a4a62a23111a2126
etag
"835e0627f21452a199165112e33979c4"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
wpcom-gray-white.png
s2.wp.com/i/logo/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s2.wp.com/i/logo/wpcom-gray-white.png
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
x-ac
3.ams _dfw
last-modified
Mon, 07 Jan 2019 04:58:00 GMT
server
nginx
etag
"5c32dc58-200b"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
8203
expires
Wed, 03 Feb 2021 04:32:50 GMT
sdk.js
connect.facebook.net/en_US/ 		389 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/sdk.js?hash=15a6526154a6e6c6a61c89eca112693d&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?_=1583298030144
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a1e0585dcf084ce5a1733822cc49a130727ade41522da51de1bfdb7f39ed42d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Origin
https://pentestlab.blog
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
CIufJMfPcHa8a0Fv4oCpOg==
status
200
date
Wed, 04 Mar 2020 05:00:30 GMT, Wed, 04 Mar 2020 05:00:30 GMT
expires
Thu, 04 Mar 2021 05:00:30 GMT
alt-svc
h3-27=":443"; ma=3600
content-length
115207
x-fb-debug
jzZkr939yPX2WQrQ+MWNZHR7PLEcs3BpVxyX7k8fyM8zQ4rPL1+wZzZ57TXJWS3I9L3SZPl1TWq0Q185x/Usog==
x-fb-trip-id
1850256238
x-fb-content-md5
87443c777f40def6126b56c654b0c329
etag
"1996845d3845ccbf04ed8ab260ce906d"
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
page.php
www.facebook.com/v2.3/plugins/ Frame 85D0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D45%23cb%3Df19b998c484abc4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3d9f344e3cba0c%26relation%3Dparent.parent&container_width=270&height=432&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&tabs=false&width=200
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=15a6526154a6e6c6a61c89eca112693d&ua=modern_es6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.3/plugins/page.php?app_id=249643311490&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D45%23cb%3Df19b998c484abc4%26domain%3Dpentestlab.blog%26origin%3Dhttps%253A%252F%252Fpentestlab.blog%252Ff3d9f344e3cba0c%26relation%3Dparent.parent&container_width=270&height=432&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fpentestlaboratory%2F&locale=en_US&sdk=joey&show_facepile=true&tabs=false&width=200
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
timing-allow-origin
*
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary
Accept-Encoding
x-content-type-options
nosniff
facebook-api-version
v2.12
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
7lrPZoMkAzZPB75ma5AXfMJ8ak+KnEFJansqI3v7phUqz1qvOqstjvg31W+5momznmiO9duWxlcbsKHM9D5vPg==
date
Wed, 04 Mar 2020 05:00:30 GMT Wed, 04 Mar 2020 05:00:30 GMT
alt-svc
h3-27=":443"; ma=3600
rate.php
polldaddy.com/ratings/ 		1 KB
447 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polldaddy.com/ratings/rate.php?cmd=get&id=5556500&uid=wp-post-27695&item_id=_post_27695
Requested by
Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
a5e6c25d73994620d70fd5c1ba5842205ad4ce59ec8363876240a13c325e2388

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-language
en
content-type
application/javascript
master.html
widgets.wp.com/likes/ Frame 9D0C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/master.html?ver=20190321
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
widgets.wp.com
:scheme
https
:path
/likes/master.html?ver=20190321
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
server
nginx
date
Wed, 04 Mar 2020 05:00:30 GMT
content-type
text/html
last-modified
Thu, 21 Mar 2019 13:37:08 GMT
vary
Accept-Encoding
etag
W/"5c939384-84e"
content-encoding
gzip
x-ac
3.ams _dfw
x-nc
HIT ams 1
1f4e2.svg
s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/ 		2 KB
981 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/1f4e2.svg
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d8c6cf2817d7a9a3fdac5ac7175d186abf4ce953c676dea858a47f3a56562f32

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Thu, 25 Aug 2016 00:35:31 GMT
server
nginx
access-control-allow-origin
*
etag
W/"57be3d53-858"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 07:37:13 GMT
1f4a1.svg
s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/wp-content/mu-plugins/wpcom-smileys/twemoji/2/svg/1f4a1.svg
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c3b0215030e98f45eafb2187a74e3c1fb7a47656b4df577c681a17d831617cd5

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-nc
HIT ams 1
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Sat, 31 Dec 2016 05:45:39 GMT
server
nginx
access-control-allow-origin
*
etag
W/"58674603-ab7"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
image/svg+xml
status
200
cache-control
max-age=31536000
x-ac
3.ams _dfw
expires
Wed, 03 Feb 2021 07:58:54 GMT
/
pentestlab.blog/2020/03/02/phishing-windows-credentials/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/?relatedposts=1
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b6a9b3202f2f2278c8287d5b532d59f1a012ff4f7d339d7cba36874dfded1564
Security Headers
Name Value
Strict-Transport-Security max-age=86400
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Sec-Fetch-Dest
empty
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-pingback
https://pentestlab.blog/xmlrpc.php
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
strict-transport-security
max-age=86400
content-type
application/json; charset=utf-8
status
200
x-ac
3.ams _dfw
hovercard.min.css
0.gravatar.com/dist/css/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/dist/css/hovercard.min.css?ver=202010y
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-1a2e"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Wed, 11 Mar 2020 05:00:30 GMT
services.min.css
0.gravatar.com/dist/css/ 		3 KB
564 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/dist/css/services.min.css?ver=202010y
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-a54"
content-type
text/css
status
200
cache-control
max-age=604800
expires
Wed, 11 Mar 2020 05:00:30 GMT
count.json
api.pinterest.com/v1/urls/ 		121 B
366 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F&_=1583298030145
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.210.248.189 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-210-248-189.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
791299016d1f96d1dfac648d523373708ba69eac71db3905aa9b735babfb6cf2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
x-content-type-options
nosniff
x-cdn
akamai
age
0
content-type
application/javascript
status
200
cache-control
private
x-envoy-upstream-service-time
1
x-pinterest-rid
0634590272425910
access-control-allow-origin
*
content-length
121
expires
Wed, 04 Mar 2020 05:15:30 GMT
/
graph.facebook.com/ 		202 B
596 B 		Script
General
Check archive.org
Download Go to
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F&_=1583298030146
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
bad5cf9ed3ce955ce5da2a69c3c57893b8497adb0b67fc861539dd53fac3730a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Wed, 04 Mar 2020 05:00:30 GMT, Wed, 04 Mar 2020 05:00:30 GMT
x-fb-rev
1001787382
alt-svc
h3-27=":443"; ma=3600
content-length
123
pragma
no-cache
x-fb-debug
XDUgYXm+me0WA1W8jKWrHbeiJybFB5grp1NCOcG0z6vPV5dJ7s8SzcmmZ2DBGXB/d0+QNeb1OaoV6dJ7nauyVg==
x-fb-trace-id
GjpzljU+6l/
etag
"daace0bd6fb770b00896d6b912b14a82e67e5a3c"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
x-fb-request-id
AN9grcmBr1OybVQ5BWTXtM-
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.12
expires
Sat, 01 Jan 2000 00:00:00 GMT
g.gif
pixel.wp.com/ 		50 B
92 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.6515134953470192
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.765904063012945
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
widget_iframe.7aeb03ce9f308997020e5998720fbbf7.html
platform.twitter.com/widgets/ Frame 5D18 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.7aeb03ce9f308997020e5998720fbbf7.html?origin=https%3A%2F%2Fpentestlab.blog
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/40DE) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
708058
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Wed, 04 Mar 2020 05:00:30 GMT
Etag
"9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified
Tue, 25 Feb 2020 00:11:30 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/40DE)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
5825
remote-login.php
r-login.wordpress.com/ Frame E0E7 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1583298009
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.18 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

:method
GET
:authority
r-login.wordpress.com
:scheme
https
:path
/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c%3D&wpcomid=32637504&time=1583298009
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
server
nginx
date
Wed, 04 Mar 2020 05:00:30 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding Cookie
expires
Wed, 11 Jan 1984 05:00:00 GMT
cache-control
no-cache, must-revalidate, max-age=0
content-encoding
gzip
x-ac
2.ams _dfw
strict-transport-security
max-age=15552000
anchor
www.google.com/recaptcha/api2/ Frame CBC3 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=v1QHzzN92WdopzN_oD7bUO2P&theme=light&size=normal&cb=bys9jh2s2di6
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-ZBpbJbW1kKqvRgQzrek2Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&co=aHR0cHM6Ly9wZW50ZXN0bGFiLmJsb2c6NDQz&hl=en&type=image&v=v1QHzzN92WdopzN_oD7bUO2P&theme=light&size=normal&cb=bys9jh2s2di6
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 04 Mar 2020 05:00:30 GMT
content-security-policy
script-src 'report-sample' 'nonce-ZBpbJbW1kKqvRgQzrek2Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
10077
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.8912757915168661
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?blog=32637504&v=wpcom&tz=0&user_id=0&post=27695&subd=pentestlab&host=pentestlab.blog&ref=&fcp=396&rand=0.4219434434645848
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
74 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29%2BSmw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8%2FMkNtblkvY1cyLHkwdzM%2FOGFCUj9bd3hNMlFQWzFGOVJ%2BbDZ%2BakRsWTBPMWU4K35pbE9IclMsLFRETiV8WUZ6SWVtdmRfd3klM0Y0UUh%2Bbys%2Fa35jaWhBV2VncFAuY2h0VkRQS2prSGtwTm56RGZIMFI0bUpRZkFybyxTUD8vNUVbME41OX5oNnV6Y29nQVpLLDdzVGVyJlZpaDRDS0JVJno%2FRHE%2FS3wvWG4uaiZ5Z1glSmdtaDNyfH5dcmZPLzk2UFZkRzJJXXhPM2I2a11TMmkyV0pLb3VXUXwmRS4tNEVKRml1bGxLaHNDTjlqYzQxU1UrTEF%2BMElCTSxyNC9Vajc%3D&v=wpcom-no-pv&rand=0.7810790910631527
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
200
date
Wed, 04 Mar 2020 05:00:30 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
button.93a0c25c2d2f3081c705c98c2d9dec0e.js
platform.twitter.com/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/js/button.93a0c25c2d2f3081c705c98c2d9dec0e.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/41AD) /
Resource Hash
cef013ba053c40f6bfa36baf6b11dca3426b1697bb52bec0902a4746f5f7d169

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Wed, 04 Mar 2020 05:00:30 GMT
Content-Encoding
gzip
Last-Modified
Tue, 25 Feb 2020 00:11:21 GMT
Server
ECS (fcn/41AD)
Age
708052
Etag
"0745fc0bb127ba13d716d66761b4628d+gzip"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Content-Type
application/javascript; charset=utf-8
Content-Length
2298
follow_button.7aeb03ce9f308997020e5998720fbbf7.en.html
platform.twitter.com/widgets/ Frame 656F 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/follow_button.7aeb03ce9f308997020e5998720fbbf7.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (fcn/41AD) /
Resource Hash

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
708048
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Wed, 04 Mar 2020 05:00:30 GMT
Etag
"137a42d1536e7968aab2dcf73ee564da+gzip"
Last-Modified
Tue, 25 Feb 2020 00:11:23 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (fcn/41AD)
Vary
Accept-Encoding
X-Cache
HIT
Content-Length
13805
index.html
widgets.wp.com/likes/ Frame 55C5 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/index.html?ver=20190321
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
widgets.wp.com
:scheme
https
:path
/likes/index.html?ver=20190321
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
server
nginx
date
Wed, 04 Mar 2020 05:00:30 GMT
content-type
text/html
content-length
126
last-modified
Sat, 23 Dec 2017 00:24:47 GMT
etag
"5a3da24f-7e"
x-ac
3.ams _dfw
x-nc
HIT ams 1
accept-ranges
bytes
bframe
www.google.com/recaptcha/api2/ Frame F8E0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=v1QHzzN92WdopzN_oD7bUO2P&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=whe7h7bwi3p7
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/v1QHzzN92WdopzN_oD7bUO2P/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-qZuH3W026T9YwWvnQedfrA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=v1QHzzN92WdopzN_oD7bUO2P&k=6LcmyE0UAAAAALID28yVNg7pFCodGaArJzHitez_&cb=whe7h7bwi3p7
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/

Response headers

status
200
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 04 Mar 2020 05:00:30 GMT
content-security-policy
script-src 'report-sample' 'nonce-qZuH3W026T9YwWvnQedfrA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1180
server
GSE
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
star-yellow-sml.png
polldaddy.com/images/ratings/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 24 Dec 2015 22:38:03 GMT
server
nginx
etag
"567c73cb-c0d"
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3085
expires
Fri, 03 Apr 2020 05:00:30 GMT
info.png
polldaddy.com/images/ratings/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://polldaddy.com/images/ratings/info.png
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js?ver=20111117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
polldaddy.com
Software
nginx /
Resource Hash
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
last-modified
Thu, 24 Dec 2015 22:38:23 GMT
server
nginx
etag
"567c73df-4ca"
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1226
expires
Fri, 03 Apr 2020 05:00:30 GMT
jot
syndication.twitter.com/i/ 		43 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://syndication.twitter.com/i/jot?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fpentestlab.blog%2F2020%2F03%2F02%2Fphishing-windows-credentials%2F%22%2C%22widget_frame%22%3Afalse%2C%22widget_site_screen_name%22%3A%22wordpressdotcom%22%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1583298030875%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%2295211fc%3A1582588547626%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D
Requested by
Host: pentestlab.blog
URL: https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.200 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://pentestlab.blog/2020/03/02/phishing-windows-credentials/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 04 Mar 2020 05:00:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200, 200 OK
x-twitter-response-tags
BouncerCompliant
strict-transport-security
max-age=631138519
content-length
65
x-xss-protection
0
x-response-time
111
pragma
no-cache
last-modified
Wed, 04 Mar 2020 05:00:30 GMT
server
tsa_o
x-frame-options
SAMEORIGIN
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
76871fa6072413dbff8b63e9fc9cd26a
x-transaction
0031cfb900289143
expires
Tue, 31 Mar 1981 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| wpcom_remote_login_extra_auth function| wpcom_remote_login_remove_dom_node_id function| wpcom_remote_login_remove_dom_node_classes function| wpcom_remote_login_final_cleanup function| addLoadEvent object| _wpemojiSettings object| twemoji object| wp object| related_posts_js_options object| NO_JQUERY object| wpcom_mobile_user_agent_info undefined| $ function| jQuery function| pm object| jQuery112406487554066383929 object| Jetpack function| highlander_expando_javascript function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz object| WPGroHo object| HighlanderComments object| WPCOM_sharing_counts object| ___grecaptcha_cfg object| grecaptcha boolean| __google_recaptcha_client object| __twttrll object| twttr object| __twttr function| XRegExp object| SyntaxHighlighter object| jpfbembed object| actionbardata object| jetpackCarouselStrings object| wpcom_img_zoomer object| jetpackLikesWidgetQueue object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady function| JetpackLikespostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| JetpackLikesWidgetQueueHandler object| wpcom object| ak_js object| commentForm undefined| replyRowContainer undefined| children object| detectZoom object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| addComment function| fbAsyncInit function| Spinner object| PDRTJS_settings_5556500_post_27695 object| recaptcha object| FB object| pd_map function| PDRTJS_url_encode function| PDRTJS_is_defined object| ratings_text function| PDRTJS_RATING object| PDRTJS_doc string| PDRTJS_id object| PDRTJS_5556500_post_27695 object| sharing_js_options object| WPCOMSharing undefined| windowOpen object| _tkq object| _stq string| mobileStatsQueryString string| new_css object| closure_lm_35982 function| st_go function| ex_go function| re_go function| linktracker_init string| className boolean| gutter number| pos

3 Cookies

Domain/Path Name / Value
.youtube.com/ Name: GPS
Value: 1
.youtube.com/ Name: YSC
Value: mUuvcXS1x3k
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: emfXG0S_imo

1 Console Messages

Source Level URL
Text
console-api log URL: https://s0.wp.com/_static/??-eJyFj9EOwiAMRX9Ihntw0wfjtyCrpAgFKbjo1wuJPrgsmjRpbnpy762co0DSrkzA0ta5FUiP9+osb+QvQHg0SWXoPNIH1oEyUG5sDJw9MCsDK1cfzuhAFIZUAco15hKWnC8iumKQWCZwNWoSzXWhVty/H0G6I8x/MQs5Kn0VCRifrfPJH/vd2B+24zDs7QszQHB9(Line 8)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=86400

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
api.pinterest.com
connect.facebook.net
graph.facebook.com
pentestlab.blog
pentestlab.files.wordpress.com
pixel.wp.com
platform.twitter.com
polldaddy.com
r-login.wordpress.com
s0.wp.com
s1.wp.com
s2.wp.com
stats.wp.com
syndication.twitter.com
widgets.wp.com
www.facebook.com
www.google.com
www.gstatic.com
www.youtube.com
104.244.42.200
192.0.123.248
192.0.72.28
192.0.76.3
192.0.77.32
192.0.78.18
192.0.78.24
23.210.248.189
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:814::2003
2a00:1450:4001:81f::2004
2a00:1450:4001:820::200e
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:e:face:b00c:0:2
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
007f9000b001df68175e08d662a8cedea42ce260ad3a27caf9a12bb27eea7f99
00db98b9eee1771f3cc2d7124438f103cfdf17fb4b46b3d3fa0962615d27e908
050c2ca74a4941fedd88349d977d960b8ab384ebb83a3c9e4b233160476ee8f1
08ac71341cf5d9e4804399f091ce495533990f6088fdf4064a3c91b1294ca4dd
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35
108f6154061a261c3c40eed6a3628d5aced38279ea1e27bb3c4a9c9aab65f8bc
130b50172d3c5db225f95db57d61ffc9b0d3ad153a4cfebf2ba78657b63622b0
13dc8c8c7423088c48d88265f5c422701f44140bd5345f2a7b54ffbef19c5831
1ba8036645d489d08bb715521c376ca173d181f90a586d9480b182346f91f67a
21c557180f1bd074974eb41ae4228b6aa9c41234ab1729d780bc8f05761110bb
25510b668f142f8d9acf744481b110f3d2790835c0f336433aaff694610e03ab
29532c4895317d4366fdb5033a2d0a3e41a47ac4016d9b6a08ac8b93d7e0735d
2b9e020056bd63eec5d5905d220780d2036ec776595cdf83eef9de3cb191366f
31f4a8f2b880703f2ba202b729d886ca7aeea8248c68cc77206a8da0378e511a
31f6f32679e3b161ac5e00a81f92df3566541e40866972decdb4a0c688d99783
32ccb9c72f3092d48c74e4fb27216eae46f8588aaa6bdb6acb2c5b8902ecce09
38235774b2d0353e9d997ff3b6d8e99fc875040b83f58b7d4564e470f795c17a
3922421878d5b0f7af38a59193191202c018da5e10fdcae3ef58f2abf360c6b8
393a213ef00f9d5ec1c6a3f26f4ee9f809ff5b9d74a58c8a6419a9ac96515bf5
3af8e77e152af71d8c85eab6af4a33318e01ced7475a13ceafa14df6224e7f4b
3b5803d4f600ba6f07f7d802daeae542dbde291aa3b1d170954ef7f5ac569563
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558
4e3c26b195de4359f1bf3711f15b4858015b006556c8e2af5c6df627a0959f7d
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0
54e398540f0808dc9f520d08256e9e5dd8129454c0066043c450d4f8f8b5c6e5
5ca5fe1659efcc3418bbf59c33c8fae29c724592e10f4846f9e88cb29259742d
62c8512b27ff9cbb23f96fd433e159b270bf3a75571a76b8428a4effc21effe0
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
6cc05bb6202411383d2bec3ff1cfbdcf5b24692a3793178d487b1d124a51687d
6d42849613c979cbd20fa9b2bc66f99ad8dad334299252851fce918531e599fb
6ff610a5bce6c0bc0ff9fd95686574b871b257996382b1e7ae1426fe0c6fceab
73c00c95fa68df5ee67dfddb73b46ad6e4eba7a7c9724e598d60e5a165f3baa1
753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b
7671be6ce10ea5a9bc530c9e03bc6ffd6b8035da6e3a41770ea08b7493ad97ae
791299016d1f96d1dfac648d523373708ba69eac71db3905aa9b735babfb6cf2
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
7c9cd4d1c41c11fc93fe07dac76018d0eba349332fbdc4bb369fc05a43f868e0
7cc264e349679f450869ba46c806ba0dbf5a525bf9eb388433ecf05bd8d06093
7f9643b7e9431350b1d76f9773ced784a3d22013dbc20b9ada4a621851de7e2b
81e13013a7ce4d80fa0abef80009e79809a890e1807a563c04ee8455637bcb27
8269e79540b61f9c52daeccf593070340da1bc8a67330476f4870f4ec7722503
82efcbd4758aa64a2a3fb4e33588cc3efca988f3704dd4cd3d551925453b4afb
877a42370ac831903fd5ed13b7882111d4f69e67e7db541c18893cfa9da3e7d1
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3
8b645b06314156c0460ada1c8d56c23656cf80fcc2482fa18d17776b6c471243
8d13ae92ee8e79364a4e3a5eb49b6eecee7b5886faece5c207ca03461af6c36b
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
8e8b3a4cbef6794fbe7700bf5b561c5e28f9d21d71ee7667b3a9a27fb73e48bd
8fafe784f7e1f13fccc7782f6c524a6f340b0b487b65c45aac414d09e6daded8
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
9717a8ee8bbe0c7d99fbba9bf7a74fc24ba7e9361221f54ca333ee30e54f4474
9814e23b7bf865b13d090bb494af3a380dde60fd6e315dd49b1c2fdaa5e0e6dc
98b36dd59d75325c3b27bd16d542933c7388c6bc21ddd66369de3f22a1344310
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
a17e2f9f05d01c0bbbe018eaa6bb91113a5b253e3f0de4719969dc936f9d5e49
a1e0585dcf084ce5a1733822cc49a130727ade41522da51de1bfdb7f39ed42d9
a5e6c25d73994620d70fd5c1ba5842205ad4ce59ec8363876240a13c325e2388
a64a672eac315b0dd89e27966e07dcb9b9e233bee3c3ed2985e254cf7eedf6f3
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0e41b2fe7c070ac096706080bd8d34e8052f65d0efe0b4f00fd93658516a836
b3616265edff5734701c605ba5bf8af99535bbbb45195a896c7e3e1766a211d7
b6a9b3202f2f2278c8287d5b532d59f1a012ff4f7d339d7cba36874dfded1564
b98f6ea3b17dd46177f43acc79deb510787da7799ebf5ce7bb72d3bc9928f343
babd2cd912a94c73f80c7ae33cfbd73db5bf4b4fe1f8437bbe7416d4585a3bac
bad5cf9ed3ce955ce5da2a69c3c57893b8497adb0b67fc861539dd53fac3730a
bb0ad39a956ea689a5f992ce22ee39329ef342c9e18c9679904c56d7aebaf96c
bcce0a9017530c0dc1d1a3199cfc52ba882bb66bdde7cf245054ba33775f86f0
bec55f93f48d9f10c9899d4755533c197768f85046999c01a14ce8fc059e7393
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c3b0215030e98f45eafb2187a74e3c1fb7a47656b4df577c681a17d831617cd5
ca8af873c6dd216be263403f2fe055f46388e5531b9dc4b7942752c811feeeba
cb3e87ff58a5e66937ffb6013c8265ed549658a4ff59c1f8d8ae193f488390a5
cba32f71b1e21bb69ee0e7a94b68b7c63c95957fbd1a561c19eb9fe0f5e9c2da
cef013ba053c40f6bfa36baf6b11dca3426b1697bb52bec0902a4746f5f7d169
d195906c4caeccec39277ac592c9a37a9de6145e01ba87bf0fd9048eac93f8e0
d7ab897759e1022db1b2283a364819ad6c3a8452d790b8fba91daaf1fd3f89ee
d8c6cf2817d7a9a3fdac5ac7175d186abf4ce953c676dea858a47f3a56562f32
e6d170af18ce67bba11e319fb3abd1356b3d9bdfc299c6df50b9fe789912ba7b
e801578e5cbc2637ac9f9762a2862e1a31061f0b0af5f30560c5d1bc52d07ac7
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
efc3abc411abb4d3e6a36ec48ed34f464040c8113257130d8d02cb928b813ea3
f1d7998f35c7e1f95a3c7276ae470ea7b94e24a45f7994078bfc5a628a0f6afc
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f70105713f94f1ba576cdc834e7a22897caa254a1b274a2a4dc7bee2ae9030da