urlscan.io logo urlscan.io
SecurityTrails logo

www.wordfence.com Open in urlscan Pro
2600:9000:2156:1000:6:6d48:6fc0:93a1  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Submission: On December 12 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 15 IPs in 5 countries across 17 domains to perform 65 HTTP transactions. The main IP is 2600:9000:2156:1000:6:6d48:6fc0:93a1, located in United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is www.wordfence.com.
TLS certificate: Issued by Amazon on November 28th 2019. Valid for: a year.
This is the only time www.wordfence.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
40 2600:9000:215... 16509 (AMAZON-02)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
10 2a04:fa87:fff... 2635 (AUTOMATTIC)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 3 72.247.224.172 16625 (AKAMAI-AS)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2 52.215.154.28 16509 (AMAZON-02)
65 15
40    2600:9000:2156:1000:6:6d48:6fc0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.wordfence.com
1    2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
maxcdn.bootstrapcdn.com
10    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
secure.gravatar.com
1    2606:4700::6811:ba49 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hsforms.net
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
1    2606:4700::6810:5505 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
forms.hsforms.com
2    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2606:4700::6811:d4cc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hs-scripts.com
1    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:825::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
1    2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    2606:4700::6811:44b0 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
js.hs-analytics.net
3    72.247.224.172 (United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a72-247-224-172.deploy.static.akamaitechnologies.com
s.adroll.com
2    2606:4700::6810:fa05 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
track.hubspot.com
2    52.215.154.28 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-215-154-28.eu-west-1.compute.amazonaws.com
d.adroll.mgr.consensu.org
d.adroll.com
Domain Requested by
40 www.wordfence.com www.wordfence.com
10 secure.gravatar.com www.wordfence.com
3 s.adroll.com 1 redirects www.wordfence.com
2 track.hubspot.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
1 d.adroll.com
1 d.adroll.mgr.consensu.org 1 redirects
1 js.hs-analytics.net js.hs-scripts.com
1 fonts.gstatic.com www.wordfence.com
1 fonts.googleapis.com js.hsforms.net
1 www.google.de www.wordfence.com
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 js.hs-scripts.com www.googletagmanager.com
1 forms.hsforms.com js.hsforms.net
1 www.googletagmanager.com www.wordfence.com
1 js.hsforms.net www.wordfence.com
1 maxcdn.bootstrapcdn.com www.wordfence.com
65 18
Subject Issuer Validity Valid
*.wordfence.com
Amazon		 2019-11-28 -
2020-12-28		 a year crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA		 2018-09-06 -
2020-09-05		 2 years crt.sh
ssl766686.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-12-06 -
2020-06-13		 6 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh
ssl431287.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-07-24 -
2020-01-30		 6 months crt.sh
ssl817718.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-08-13 -
2020-02-19		 6 months crt.sh
www.google.de
GTS CA 1O1		 2019-11-05 -
2020-01-28		 3 months crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh
*.google.com
GTS CA 1O1		 2019-11-13 -
2020-02-05		 3 months crt.sh
ssl803670.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-11-06 -
2020-05-14		 6 months crt.sh
*.adroll.com
DigiCert SHA2 Secure Server CA		 2018-12-19 -
2020-03-19		 a year crt.sh
hubspot.com
CloudFlare Inc ECC CA-2		 2019-12-04 -
2020-10-09		 10 months crt.sh
adroll.mgr.consensu.org
Amazon		 2019-11-06 -
2020-12-06		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.wordfence.com/blog/2017/06/wso-shell/
Frame ID: E8ED2CF9703D177F18DD02EFD856B540
Requests: 65 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • html /<!-- (?:End )?Google Tag Manager -->/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+ionicons(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Page Statistics

65
Requests

100 %
HTTPS

88 %
IPv6

17
Domains

18
Subdomains

15
IPs

5
Countries

671 kB
Transfer

1591 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=121261297&t=pageview&_s=1&dl=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&ul=en-us&de=UTF-8&dt=WSO%20Shell%3A%20The%20Hack%20Is%20Coming%20From%20Inside%20The%20House!&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=249286398&gjid=346936634&cid=137916127.1576182832&tid=UA-248353-24&_gid=2006649478.1576182832&_r=1&gtm=2wgc61K9CP2C8&z=182233201 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_gid=2006649478.1576182832&gjid=346936634&_v=j79&z=182233201 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201&slf_rd=1&random=669445618
Request Chain 62
  • https://s.adroll.com/j/exp/KDBENRHVB5HTRGESEMIJFG/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 63
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/KDBENRHVB5HTRGESEMIJFG?_s=12c41afc5ca843025f281888124bd164&_b=2 HTTP 302
  • https://d.adroll.com/consent/check/KDBENRHVB5HTRGESEMIJFG/?_s=12c41afc5ca843025f281888124bd164&_b=2

65 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.wordfence.com/blog/2017/06/wso-shell/ 		47 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
ba178b7d8154fa5ca570a96b6aa9ac806867a6414924e3f714b89ab551e188ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Request headers

:method
GET
:authority
www.wordfence.com
:scheme
https
:path
/blog/2017/06/wso-shell/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
content-type
text/html; charset=UTF-8
content-length
13145
date
Thu, 12 Dec 2019 20:33:51 GMT
set-cookie
AWSALB=tp68gT2nOOap4xoq3khKsashRrfJroO7YItGq5mszJO0dsAhKXA5MbPMTVVi+KY9GOT+JfyS82oAxTPBfTZk/p79AJzuXMX2ZpyU/jwOi1gOhDSO6pvp+S7qs4qT; Expires=Thu, 19 Dec 2019 20:33:50 GMT; Path=/
server
Apache
link
<https://www.wordfence.com/wp-json/>; rel="https://api.w.org/" <https://www.wordfence.com/?p=17162>; rel=shortlink
content-encoding
gzip
x-xss-protection
1 ; mode=block
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
strict-transport-security
max-age=31536000;includeSubDomains;preload
vary
Accept-Encoding
x-cache
Miss from cloudfront
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
4JsVldfs8nicFc_ZqW6GYJIynkz6y71XbCDutvkUOaBDYEJoUOEEEQ==
style.min.css
www.wordfence.com/wp-includes/css/dist/block-library/ 		40 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-includes/css/dist/block-library/style.min.css?ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Dec 2019 17:03:44 GMT
content-encoding
gzip
last-modified
Wed, 13 Nov 2019 18:00:03 GMT
server
AmazonS3
age
99008
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
YHKtGqLYhasZgxNHZ8ytL3MdVezz8O9LLZQ1UxSv-1RYoZxBidAARQ==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
style.css
www.wordfence.com/wp-content/plugins/fm-social-share/css/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/fm-social-share/css/style.css?ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c6f993564578ff62e1c2c45d8ac852c6c1d8e76e92a6d141e5100fc8582a8ff0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:13 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:10 GMT
server
AmazonS3
age
49839
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
uen507WfiXhjpDGGtYslARFGIj10c5-m5fr-xnBX4KVMApkDY5VY8g==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
ss-standard.css
www.wordfence.com/wp-content/plugins/wordfence-keys/fonts/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/fonts/ss-standard.css?ver=1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a8885806e666593ea024208a7ba66a0195d7c6252070b501bc00695bbedac513

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:14 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:12 GMT
server
AmazonS3
age
49838
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
e43PGFFacqB9zx9M4maWmk814UQ14Lqxn8aCdeqzMJbhJSC0BpfkgQ==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
style.css
www.wordfence.com/wp-content/plugins/wordfence-keys/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/css/style.css?ver=2019.5.1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ce05c8817b07acc2fda12e14a45a20d35689991a5b0e03be1c58c987e1b2b76f

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:13 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:12 GMT
server
AmazonS3
age
49839
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
byo9gkOw8P1GYqIC1jgFCHKKZfSLk1AOsp5qUcIl4iE01bDAJiXTKA==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/latest/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/latest/css/font-awesome.min.css?ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:51 GMT
content-encoding
gzip
last-modified
Sat, 17 Feb 2018 21:46:17 GMT
access-control-allow-origin
*
etag
"1518903977"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
7050
wordfence-metrics.css
www.wordfence.com/wp-content/plugins/wordfence-metrics/css/ 		2 KB
894 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-metrics/css/wordfence-metrics.css?ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
18600d985076a482e5b8f07993b3dfe340a515d25a2328b090922c620f7347be

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:15 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:13 GMT
server
AmazonS3
age
49837
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
AKV6mZxB--1_RerGNYiD9k5TPANzcCSp0AFLFHbTXq3rNrqpJGOQjQ==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
googlefonts.css
www.wordfence.com/wp-content/themes/wordfence/css/ 		24 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
52e9583eff72276651bd501d6643a061dae2e49b9e770b500df0fa66477b449d

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:15 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:18 GMT
server
AmazonS3
age
49837
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
Z9RvO4c3N3XCIsPtuCY_zIK-fm4Bh2mfKWqTQs9b66yQ0wWQRDmXUQ==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
ionicons.min.css
www.wordfence.com/wp-content/themes/wordfence/css/ 		50 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/css/ionicons.min.css
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 08 Dec 2019 16:55:01 GMT
content-encoding
gzip
last-modified
Tue, 22 Oct 2019 21:05:20 GMT
server
AmazonS3
age
358731
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
bZeofuuT70wkmPPSFIF7PldQm0CO-ikH505Kx50T1QbPzle5-dAyAw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
style.css
www.wordfence.com/wp-content/themes/wordfence/ 		82 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/style.css?ver=2019.11.1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b2dcab60c16edff723e82f94bf91842a4066949a79e417a838e6202c88bb50a7

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Dec 2019 18:42:55 GMT
content-encoding
gzip
last-modified
Wed, 13 Nov 2019 18:00:21 GMT
server
AmazonS3
age
93057
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
1GM6hC83X2l_AvHNETcRwK916g62R9hLJT9IG-z08tbDBg42P16TIw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
load-scripts.php
www.wordfence.com/wp-admin/ 		104 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate&ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
2f63cd9333bbcb3708b95c29c01cdb017587972ebc5f49d7063351b2858fa356
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 13 Nov 2019 17:54:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2514190
x-cache
Hit from cloudfront
status
200
strict-transport-security
max-age=31536000;includeSubDomains;preload
content-length
37223
x-xss-protection
1 ; mode=block
server
Apache
x-frame-options
SAMEORIGIN
etag
5.3
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
4J_eDFcJw_SSZlgp1EnUvVOJCMPeGMhIg0HBOaJc0rHGr1yKmfq2Rw==
expires
Thu, 12 Nov 2020 17:54:57 GMT
modernizr-2.8.3.min.js
www.wordfence.com/wp-content/themes/wordfence/js/vendor/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/js/vendor/modernizr-2.8.3.min.js
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:16 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:22 GMT
server
AmazonS3
age
49836
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
L3tn_Fr7mzZugSMaYlBtFXV40ifu9KOzvX9RItLJ_1EqWy3fsKGs1w==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
logo-wordfence.svg
www.wordfence.com/wp-content/themes/wordfence/img/ 		5 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/img/logo-wordfence.svg
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
387394872cd58f7303cb824544bcaa88ce3144ed3fc2f4dea4f3769e237d164d

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:18 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:21 GMT
server
AmazonS3
age
49833
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
sMzWTjZe73fOVBQbkswOyU2XYyHmKFNSKjzxn8lGn6T52wh1M9nE8w==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
image1.png
www.wordfence.com/wp-content/uploads/2017/06/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/uploads/2017/06/image1.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58e7874083cadfbbefed6c819fdd8d6c1bfb6ecf7f5ff311bacbcf9a98efd73e

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:52 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"8d8693d531071e13a4d26b4a3a7cef3f"
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
21638
x-amz-cf-id
BzejAp2p32w0t7LhJnt3W8lXFwgIhRmS6Tk-cERhzRm3A6yDYWrAyg==
image2.png
www.wordfence.com/wp-content/uploads/2017/06/ 		25 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/uploads/2017/06/image2.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ad6413f3288018f1d25ada963f8f32a2042f217d85fd15b75a82bc20ca9a7fa0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:52 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"6752ddca1e71740d7e56f22efac96c50"
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
25983
x-amz-cf-id
HXI4Wl2SBRg8NFovSUgpXDyqIw65Ub5e7rUUrGTtWnDT7E8I93XxtQ==
image3.png
www.wordfence.com/wp-content/uploads/2017/06/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/uploads/2017/06/image3.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f980136e6d20acda1b61bbe4b3dbaf38bc685d913b27f7c1b5d474a0591bc7b4

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:52 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"4a7c55fb3aab21ccf71444fa8f719fde"
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
17573
x-amz-cf-id
YAB-CJ2xU0g08gw-8wy5UxjcXqViHvGwff6or0wDLWy2EpMW_wrPSg==
2682d5879bc9af732efc760b03c4477d
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/2682d5879bc9af732efc760b03c4477d?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 1
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14161899
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="2682d5879bc9af732efc760b03c4477d.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/2682d5879bc9af732efc760b03c4477d?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
308edbfeedb414ec13b6ec2954d91554
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/308edbfeedb414ec13b6ec2954d91554?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14161899
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="308edbfeedb414ec13b6ec2954d91554.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/308edbfeedb414ec13b6ec2954d91554?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
194c14831520b3cd749dd3b697284ced
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/194c14831520b3cd749dd3b697284ced?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14161899
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="194c14831520b3cd749dd3b697284ced.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/194c14831520b3cd749dd3b697284ced?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
0d4a456ed71220be6d2567ef9812f80c
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/0d4a456ed71220be6d2567ef9812f80c?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14193345
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="0d4a456ed71220be6d2567ef9812f80c.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/0d4a456ed71220be6d2567ef9812f80c?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
55502f40dc8b7c769880b10874abc9d0
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/55502f40dc8b7c769880b10874abc9d0?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 3
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14400823
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="55502f40dc8b7c769880b10874abc9d0.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/55502f40dc8b7c769880b10874abc9d0?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
cf53f2c468e443ec3cb67bb0965fa900
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/cf53f2c468e443ec3cb67bb0965fa900?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 1
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
9525938
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="cf53f2c468e443ec3cb67bb0965fa900.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/cf53f2c468e443ec3cb67bb0965fa900?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
690083e8b792cd5d273c2545a2095d28
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/690083e8b792cd5d273c2545a2095d28?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 2
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14161899
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="690083e8b792cd5d273c2545a2095d28.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/690083e8b792cd5d273c2545a2095d28?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
d0feee6043bef42ab089e2c20c12e977
secure.gravatar.com/avatar/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/d0feee6043bef42ab089e2c20c12e977?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
396ad48b8a7cd2a2b2107e378bd1f66d15b40b4fb517da2038538e3acad2ae6d

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 3
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Fri, 31 May 2019 16:56:31 GMT
server
nginx
access-control-allow-origin
*
source-age
14367203
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="d0feee6043bef42ab089e2c20c12e977.jpeg"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/d0feee6043bef42ab089e2c20c12e977?s=96&d=mm&r=g>; rel="canonical"
content-length
4136
expires
Thu, 12 Dec 2019 20:38:51 GMT
669e464f6a0301365a202be2c64bd20c
secure.gravatar.com/avatar/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/669e464f6a0301365a202be2c64bd20c?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
14161899
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="669e464f6a0301365a202be2c64bd20c.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/669e464f6a0301365a202be2c64bd20c?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Thu, 12 Dec 2019 20:38:51 GMT
0c8ceae7f4f9fc84c241b73b7d9275f6
secure.gravatar.com/avatar/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/0c8ceae7f4f9fc84c241b73b7d9275f6?s=96&d=mm&r=g
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
10d8dc6f3a624dd15a719f89c5ffd243575baf446b442731d78987cfe97aa165

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc
HIT vie 4
date
Thu, 12 Dec 2019 20:33:51 GMT
last-modified
Mon, 26 Dec 2016 12:29:21 GMT
server
nginx
access-control-allow-origin
*
source-age
14161898
content-type
image/png
status
200
cache-control
max-age=300
content-disposition
inline; filename="0c8ceae7f4f9fc84c241b73b7d9275f6.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/0c8ceae7f4f9fc84c241b73b7d9275f6?s=96&d=mm&r=g>; rel="canonical"
content-length
16634
expires
Thu, 12 Dec 2019 20:38:51 GMT
promo-logo.png
www.wordfence.com/wp-content/themes/wordfence/img/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/img/promo-logo.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
10a368402e1e0783c47509207e9ebf37baa03d6ceb4314aba95d5bcd0ef36f14

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 30 Nov 2019 23:17:16 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 13 Nov 2019 18:00:21 GMT
server
AmazonS3
age
421361
etag
"97a1e794241d0cf9cf479311d6ab496d"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
10913
x-amz-cf-id
4shMDVdR7zUEFRMBuP6qxV27Blt46m22LxJ4hmP4VtLLqk910pwjbw==
v2.js
js.hsforms.net/forms/ 		418 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hsforms.net/forms/v2.js
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:ba49 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1e54f3fe3290ecc4c8474d7bee91ecdb173921702de9a8f127ac28a18bacdcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:51 GMT
via
1.1 2e50d9b1ee017f302768660f02b7418e.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
262
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-amz-version-id
rSLg1kM0E2wc3M1ChjIUpj5ak3JTv4Dg
last-modified
Tue, 10 Dec 2019 03:41:57 GMT
server
cloudflare
etag
W/"dc174e11f10c1ab65b7ec8796e0f0477"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=600
x-amz-cf-pop
IAD89-C1
cf-ray
544279c7bf8ecb98-VIE
x-amz-cf-id
sf1zrqT4qk7AK-GJN7R6HcE7OVZW4g6Q4c87Jp314fNXaxsAL8q5dg==
logo-defiant.svg
www.wordfence.com/wp-content/themes/wordfence/img/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/img/logo-defiant.svg
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
777ffc53909497266f144583fb49d1b2f8fbe0d115964de18539b80257c9ad25

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:18 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:21 GMT
server
AmazonS3
age
49834
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
f6ma4iw5suDZGCDDs7s1Mx-bB5m9VbH11eT6scq7pWmwKKzdaaCYOw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
ico-twitter.png
www.wordfence.com/wp-content/uploads/2018/11/ 		548 B
896 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/uploads/2018/11/ico-twitter.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7ab1aa8ac7913698d8f08727b46b369e4c83102af45da4669ca2d787c243ae49

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:17 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Thu, 26 Sep 2019 20:20:53 GMT
server
AmazonS3
age
49835
etag
"fecd9466b173a680c8f830eb7c2f238f"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
548
x-amz-cf-id
sv8YPHFg4SKqVEP7WQi3smcJtfC3Kb5ZRGVame4i3FNoTwMZEhgnIA==
ico-facebook.png
www.wordfence.com/wp-content/uploads/2018/11/ 		260 B
609 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/uploads/2018/11/ico-facebook.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bc8c5d879271f87bbb499227284e7ce29713f23f52396444f79126d2c2f185ee

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 08 Dec 2019 16:55:02 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 13 Nov 2019 18:00:52 GMT
server
AmazonS3
age
358730
etag
"6f9f59ed05bd4f3ca8706503cebb7c2d"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
260
x-amz-cf-id
KOmN0YSIWyP-jqcsDeNeHmyr1D1sqG7AsTAf-WeGw0nutxGwUlIIYg==
load-scripts.php
www.wordfence.com/wp-admin/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=wp-embed&ver=5.3
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Apache /
Resource Hash
48f76f0495fc1c515d7be06e324a852c342ea9fbf2897d8d190d84dfe4c41288
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 13 Nov 2019 17:54:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2514190
x-cache
Hit from cloudfront
status
200
strict-transport-security
max-age=31536000;includeSubDomains;preload
content-length
742
x-xss-protection
1 ; mode=block
server
Apache
x-frame-options
SAMEORIGIN
etag
5.3
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
I8-IRluU68XArmYOoW4DTwXW8fZN2QRzYGi8mLmQqyuBsVqBnW5hgg==
expires
Thu, 12 Nov 2020 17:54:57 GMT
raven.min.js
www.wordfence.com/wp-content/plugins/wordfence-keys/js/ 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/js/raven.min.js?ver=3.26.4
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 07 Dec 2019 23:31:11 GMT
content-encoding
gzip
last-modified
Wed, 04 Dec 2019 21:55:16 GMT
server
AmazonS3
age
421361
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
j3e6jDqAkuDQaHnNqnW97CyZF7wlUxORS1uHfRBBwy-YZkC02RaWRw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
raven-config.js
www.wordfence.com/wp-content/plugins/wordfence-keys/js/ 		41 B
398 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/js/raven-config.js?ver=1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a03287087bd08afc2412881bda41c5a46a4f9fb9a603a48c2c619cb86e2b110a

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 06 Dec 2019 23:59:22 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Tue, 22 Oct 2019 21:05:14 GMT
server
AmazonS3
age
506070
etag
"358d191e265fea8e61e1d0f3007f5efc"
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
41
x-amz-cf-id
F_FdZzrEPPYVcEZMak2JBtlzWMfG5TGklu8NwS3Rh9_d5oF-dvlozw==
jquery.tmpl.min.js
www.wordfence.com/wp-content/plugins/wordfence-keys/js/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/js/jquery.tmpl.min.js?ver=1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
af6592d435a34ae2cbc384c908b2000e3a33f3c3d7bace1a84ba7880a8a80d9e

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:15 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:12 GMT
server
AmazonS3
age
49836
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
djeOsR7mXei6FkuGvOzerV9yv_oUv5Cu-kHS_d0aT9pLxBfIiBpduA==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
jquery.payment.min.js
www.wordfence.com/wp-content/plugins/wordfence-keys/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/js/jquery.payment.min.js?ver=1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b51437c45c2be6ce00a55faa767e3773c0b93cc04394fb8ffe57ce59e3d8009e

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:13 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:12 GMT
server
AmazonS3
age
49839
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
WOyw_nvocQ6lkGJEI_2q2khXHo-PpNYNeVGH1LgryjKVautUW6edZw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
wfKeys.js
www.wordfence.com/wp-content/plugins/wordfence-keys/js/ 		54 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-keys/js/wfKeys.js?ver=2019.8.2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9fd19e4b0367465b629c80d5c1adfad29f9a7351aee7243826d62d18428447d4

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:14 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:12 GMT
server
AmazonS3
age
49838
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
MjKY08X2tn8SjEbJ6Y_VhL-UtBw5I2klOzvBdNS-OZKeYCSl1ESCAg==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
jquery.barrating.min.js
www.wordfence.com/wp-content/plugins/wordfence-metrics/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-metrics/js/jquery.barrating.min.js?ver=1.2.1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f1e69ff4360cc12fb5c0cf38f19eaa74a2216893fe3cad6936d00fcc49b1bf57

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:15 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:13 GMT
server
AmazonS3
age
49837
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
YdYS0SskOfnSS4bXgRc4BwGzZFfsYJlIgL3D0M9JZKG6NayrM3YuqA==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
wordfence-metrics.js
www.wordfence.com/wp-content/plugins/wordfence-metrics/js/ 		1 KB
815 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/plugins/wordfence-metrics/js/wordfence-metrics.js?ver=1.0.0
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c41d674623a722fa0d7e0adeea621208a71b87813c1e09680298c15240853a83

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:16 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:13 GMT
server
AmazonS3
age
49836
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
Oxnh5LCljOi9TthOA9S7p5j4hqCVHDy9qZFezwzPXQ_JUuHZBXENYw==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
app.js
www.wordfence.com/wp-content/themes/wordfence/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/js/app.js?ver=2019.11.1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9e70ed29e1b923f467bdef455e745cd6228e2b6404f5647b277bd6cfe4aec2f0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:15 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:22 GMT
server
AmazonS3
age
49837
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
sEAOVD3-PHH_NBELK_mIlEico1niJaY6KQIKoWcQH7_Jlx1WEdOJUA==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
jquery.customSelect.min.js
www.wordfence.com/wp-content/themes/wordfence/js/vendor/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/js/vendor/jquery.customSelect.min.js?ver=1
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
94eb062f034d9c0a3631943344065bc2e07d520367312378b596f2b1f2a65109

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:14 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:22 GMT
server
AmazonS3
age
49838
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
UrP8mX_TrBNn2SmJjMMY5S2jL1yKhr9Xkf-GyKcHQ3GEVc-3kak5Cg==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
gtm.js
www.googletagmanager.com/ 		66 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-K9CP2C8
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b0dcfe7b0cad4d27b5dda5e3d65780191e4e98dac7ef777b3bb3149830fc5a0e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:51 GMT
content-encoding
br
last-modified
Thu, 12 Dec 2019 18:14:41 GMT
server
Google Tag Manager
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
23903
x-xss-protection
0
expires
Thu, 12 Dec 2019 20:33:51 GMT
roboto-KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		10 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/roboto-KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/wp-content/themes/wordfence/js/vendor/modernizr-2.8.3.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Mon, 09 Dec 2019 05:33:40 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
age
313212
etag
"ece6673e477b4d7aca12f04dace5ed60"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
10748
x-amz-cf-id
QOeYkJkIQMJuwOTZBxmUV_jTWB_tYEDdlxi_GO684FtJYuRrYhvRMw==
ico-sign-in-link.svg
www.wordfence.com/wp-content/themes/wordfence/img/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/img/ico-sign-in-link.svg
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
99730d0c4ecb5c986245fb33c304cd632c959f9c25d91ac49d88f52b817a6c6d

Request headers

Referer
https://www.wordfence.com/wp-content/themes/wordfence/style.css?ver=2019.11.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 06:43:19 GMT
content-encoding
gzip
last-modified
Thu, 26 Sep 2019 20:20:21 GMT
server
AmazonS3
age
49833
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
tljcwPs1Rl8zbc7sf3j4CMdFhjEZncqTMv-yllefh2BbikUBeapx4w==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
bg-hero-page.png
www.wordfence.com/wp-content/themes/wordfence/img/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/img/bg-hero-page.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
83581bf3a1c3676d054508897d6f9d756fdd29d74578a03c5095c9b180eb5a8a

Request headers

Referer
https://www.wordfence.com/wp-content/themes/wordfence/style.css?ver=2019.11.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:53 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"4db5f48c3510a26a53b442c3e70a2f73"
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
12296
x-amz-cf-id
qM8aFUJQUM6ijh3h2EddSZ5MFL2PIIh5Xr4cNqER2EWyFO3D3mo31Q==
bg-fm_social_share_button-ico.png
www.wordfence.com/wp-content/plugins/fm-social-share/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.wordfence.com/wp-content/plugins/fm-social-share/img/bg-fm_social_share_button-ico.png
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
74252b0bdbbec37155b3b0eb4db3fedb4b5b0f0bc26d7315b76f306d44facff5

Request headers

Referer
https://www.wordfence.com/wp-content/plugins/fm-social-share/css/style.css?ver=5.3
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Dec 2019 22:11:14 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:14 GMT
server
AmazonS3
age
80558
etag
"d8741cc5e2909668494f5fd50f73745c"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
2560
x-amz-cf-id
QiDEROw39x4NtU23ITZB1UYEHTua0-oWTBrXe06a_6mkrbRSK2CGXA==
roboto-KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/roboto-KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Sun, 08 Dec 2019 14:37:38 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
age
366974
etag
"709f6f90c7d493cd16b8cd087df492ab"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
10788
x-amz-cf-id
WzZVp5EvrR2oFe1ly-fOfp4t5Hl_PLIchklCrgrju8H4983jodS5Rw==
roboto-KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/roboto-KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Mon, 09 Dec 2019 05:33:40 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
age
313212
etag
"0b81348c81e06b7cb84c7856e13fdb4c"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
10764
x-amz-cf-id
V8-0I7KhGC06lU_i7lf8FGSR2CpnHQDM-amR9qs7Hql0A5ull4Nw4g==
robotoslab-BngRUXZYTXPIvIBgJJSb6u9mxLCGwR2oefDo.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/robotoslab-BngRUXZYTXPIvIBgJJSb6u9mxLCGwR2oefDo.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
be324f832c99a743be6e9bb6e888e37f1d6ad4e3fb0b9390477a40c2d5d6ce99

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Sun, 08 Dec 2019 21:50:11 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Thu, 26 Sep 2019 20:20:19 GMT
server
AmazonS3
age
341020
etag
"9189c47ec3a6de4191ec6d71dbba7a0f"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
11092
x-amz-cf-id
-HYFs1jIrlZfQNIkM9ExgaRk3UqZjuwas1FW8D1myY8imoxC4RGohQ==
roboto-KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/roboto-KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
64565561ddb338a11ffce5b84aa53fa6e8fd203c34208e61eb5602cd08bf527f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Thu, 12 Dec 2019 20:33:53 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"7a7b77b774f5049025a262a84c17b99b"
x-cache
Miss from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
12352
x-amz-cf-id
EoSZEcnCHq6h3YjIiOkmkej383G8sd7fdDSKafHSOdqPFDpbfzaOfQ==
robotoslab-BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/robotoslab-BngRUXZYTXPIvIBgJJSb6u92w7CGwR2oefDo.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8c055f4fc89b73bc480ac07d607782cb3482fc98cbec6f89135ff76ce5512280

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Thu, 12 Dec 2019 20:33:53 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"70b9542e5bb3034d4e811fd1cd0d1342"
x-cache
Miss from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
11096
x-amz-cf-id
46X8OeceNQAxBzw-QVhBOMmcLsJInKaxPjn4R1dIB7-mHK351GQzuA==
ionicons.ttf
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		184 KB
108 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/ionicons.ttf?v=2.0.0
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/ionicons.min.css
Origin
https://www.wordfence.com

Response headers

date
Wed, 11 Dec 2019 22:11:14 GMT
content-encoding
gzip
last-modified
Wed, 04 Dec 2019 21:55:23 GMT
server
AmazonS3
age
80557
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/font-sfnt
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
Rw20tkuaUVag4oin3sAA25VqJfPNI0zYf2d9FfbdndcILv3CuhVVDA==
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
robotoslab-BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2
www.wordfence.com/wp-content/themes/wordfence/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.wordfence.com/wp-content/themes/wordfence/fonts/robotoslab-BngMUXZYTXPIvIBgJJSb6ufN5qWr4xCC.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2156:1000:6:6d48:6fc0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
11f18af740f9727666190b83a8999d30ade3421e0148bf1b1586eaaad25dd781

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://www.wordfence.com/wp-content/themes/wordfence/css/googlefonts.css
Origin
https://www.wordfence.com

Response headers

date
Sun, 08 Dec 2019 00:26:07 GMT
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 21:55:24 GMT
server
AmazonS3
age
418065
etag
"4852cc21192d1ae8b696fb26431455a1"
x-cache
Hit from cloudfront
content-type
binary/octet-stream
status
200
cache-control
max-age=604800
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-length
10988
x-amz-cf-id
jZ1kPXY4OD1rteaoqUy-Pl34GRgZd9z8hRrmIio2TKpJX3Lnchv57w==
7e580360-6f66-4d96-a898-0bd11eec900a
forms.hsforms.com/embed/v3/form/4354010/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://forms.hsforms.com/embed/v3/form/4354010/7e580360-6f66-4d96-a898-0bd11eec900a?callback=hs_reqwest_0&hutk=
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5505 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bf8036a5299f33867ac6799a454ecca3551be28f5bc1a64566356147270e592
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
x-trace
2B8527D23340D15B9532C888C30AE69E28DD54FCE0000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
status
200
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
false
content-disposition
attachment; filename=no-rfd.txt
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
544279c9ef0acb98-VIE
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9CP2C8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
14
date
Thu, 12 Dec 2019 20:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Thu, 12 Dec 2019 22:33:37 GMT
4354010.js
js.hs-scripts.com/ 		441 B
806 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/4354010.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K9CP2C8
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:d4cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c85da21ccf254429d4d87ece4b37d478c96f75817004de6a21fb482199773f7a

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
status
200
access-control-max-age
3600
content-length
311
server
cloudflare
x-trace
2BF766B9422FC0952CED0A7C2B7B88C01A96E3D082000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.wordfence.com
cache-control
public, max-age=60
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
544279cae857cbcc-VIE
expires
Thu, 12 Dec 2019 20:34:52 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j79&a=121261297&t=pageview&_s=1&dl=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&ul=en-us&de=UTF-8&dt=WSO%20Shell%3A%20The%20Ha...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_gid=2006649478.1576182832&gjid=346936634&_v=j79&z=182233201
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201&slf_rd=1&random=669445618
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201&slf_rd=1&random=669445618
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 12 Dec 2019 20:33:51 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 12 Dec 2019 20:33:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-248353-24&cid=137916127.1576182832&jid=249286398&_v=j79&z=182233201&slf_rd=1&random=669445618
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ 		2 KB
591 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e5b09ae4f391ccd8e04977e2330f1e533a2a507d95c609a3fd437a7ffc7cddfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Thu, 12 Dec 2019 20:33:51 GMT
server
ESF
access-control-allow-origin
*
date
Thu, 12 Dec 2019 20:33:51 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
0
expires
Thu, 12 Dec 2019 20:33:51 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto
Origin
https://www.wordfence.com

Response headers

date
Thu, 21 Nov 2019 15:36:21 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
1832250
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11016
x-xss-protection
0
expires
Fri, 20 Nov 2020 15:36:21 GMT
4354010.js
js.hs-analytics.net/analytics/1576182600000/ 		74 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1576182600000/4354010.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/4354010.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6811:44b0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba688fb8d66281a3d1803177b25b494a9b63c7f23f0b004ed004de19e228a6bc

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
content-encoding
gzip
cf-cache-status
MISS
x-amz-request-id
75550A896157F573
status
200
content-type
text/javascript
x-amz-id-2
ueLLeOGFL8AnMvpNzky8+XbZp5VESRmzqSr+AHDEjNepAfLbgDV9sYvJlQdMg/LAhBudzMMLBkA=
last-modified
Tue, 29 Oct 2019 20:53:07 GMT
server
cloudflare
etag
W/"445403e422519a187af0dac1606670b8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
null
cache-control
max-age=300, public
access-control-allow-credentials
false
cf-ray
544279cdfad4cbcc-VIE
expires
Thu, 12 Dec 2019 20:38:52 GMT
roundtrip.js
s.adroll.com/j/ 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.wordfence.com
URL: https://www.wordfence.com/blog/2017/06/wso-shell/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.224.172 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-224-172.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
daa6234745ee9254daffaab8cf80f1d5635c59e61f0d5b2b2cd0e15e627f2880

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
F0KGs_qBh8Uo3GutiGl9D9wf37h9WAQ5
Content-Encoding
gzip
x-amz-request-id
C7C86A6FB1908F72
x-amz-server-side-encryption
AES256
Access-Control-Max-Age
600
Date
Thu, 12 Dec 2019 20:33:52 GMT
Connection
keep-alive
Content-Length
11251
x-amz-id-2
eOvVHLn5ZHsR6N1La4XniARlFzxXvOWwYdeFRscCAjRGUTrHQwiWFyq3LJ8XQik+90ZMzJpYE9U=
Last-Modified
Mon, 09 Dec 2019 19:12:52 GMT
Server
AmazonS3
ETag
"12a84834d3dac8c4d26c2ed26b1d8524"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
__ptq.gif
track.hubspot.com/ 		45 B
482 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=15&fi=7e580360-6f66-4d96-a898-0bd11eec900a&fci=501c610e-e24d-4d03-b503-6e9dd52051c1&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=4354010&rcu=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&pu=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&t=WSO+Shell%3A+The+Hack+Is+Coming+From+Inside+The+House!&cts=1576182832487&vi=b516b8d42e938216c3e4dd6e7901316f&nc=true&u=151178726.b516b8d42e938216c3e4dd6e7901316f.1576182832482.1576182832482.1576182832482.1&b=151178726.1.1576182832482
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
544279cf5a0d59be-VIE
content-type
image/gif
content-length
45
x-robots-tag
none
__ptq.gif
track.hubspot.com/ 		45 B
104 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=4354010&rcu=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&pu=https%3A%2F%2Fwww.wordfence.com%2Fblog%2F2017%2F06%2Fwso-shell%2F&t=WSO+Shell%3A+The+Hack+Is+Coming+From+Inside+The+House!&cts=1576182832489&vi=b516b8d42e938216c3e4dd6e7901316f&nc=true&u=151178726.b516b8d42e938216c3e4dd6e7901316f.1576182832482.1576182832482.1576182832482.1&b=151178726.1.1576182832482
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 12 Dec 2019 20:33:52 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI CUR ADM OUR NOR STA NID"
status
200
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
544279cf5a0e59be-VIE
content-type
image/gif
content-length
45
x-robots-tag
none
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/KDBENRHVB5HTRGESEMIJFG/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
680 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.224.172 , United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a72-247-224-172.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
cSNz2Yx55qALD5S3Ti8XDJ5WBVk7LqZ4
x-amz-request-id
DF83F4107F02A22F
x-amz-server-side-encryption
AES256
Date
Thu, 12 Dec 2019 20:33:53 GMT
Connection
keep-alive
Content-Length
28
x-amz-id-2
kJ0P+DlnVzllfpJ5+xJA+ltYCpTRen8YZEngZCNNqfZA5Vt0AG2N2KrEwEjB8pPa0lwCfJQcQPg=
Last-Modified
Mon, 09 Dec 2019 15:57:08 GMT
Server
AmazonS3
ETag
"5816cced8568d223aa09d889f300692b"
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*

Redirect headers

Date
Thu, 12 Dec 2019 20:33:53 GMT
Server
AkamaiGHost
Access-Control-Allow-Origin
*
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
0
/
d.adroll.com/consent/check/KDBENRHVB5HTRGESEMIJFG/
Redirect Chain
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/KDBENRHVB5HTRGESEMIJFG?_s=12c41afc5ca843025f281888124bd164&_b=2
  • https://d.adroll.com/consent/check/KDBENRHVB5HTRGESEMIJFG/?_s=12c41afc5ca843025f281888124bd164&_b=2
89 B
180 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/KDBENRHVB5HTRGESEMIJFG/?_s=12c41afc5ca843025f281888124bd164&_b=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.154.28 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-154-28.eu-west-1.compute.amazonaws.com
Software
nginx/1.16.1 /
Resource Hash
e8a7ecf0c7b55d3742a686c4f671351b02d7921b0b8f688080fdaac800f267e3

Request headers

Referer
https://www.wordfence.com/blog/2017/06/wso-shell/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Thu, 12 Dec 2019 20:33:53 GMT
server
nginx/1.16.1
content-length
89
content-type
application/javascript

Redirect headers

status
302
date
Thu, 12 Dec 2019 20:33:53 GMT
server
nginx/1.16.1
content-length
105
location
https://d.adroll.com/consent/check/KDBENRHVB5HTRGESEMIJFG/?_s=12c41afc5ca843025f281888124bd164&_b=2

Verdicts & Comments Add Verdict or Comment

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| dataLayer undefined| $ function| jQuery object| html5 object| Modernizr object| globalRoot function| hns object| hubspot object| hbspt object| __hsRoot object| hspreserve undefined| React undefined| reqwest function| OutpostErrorReporter undefined| Pikaday function| hns2 function| hmerge undefined| I18n undefined| ReactDOM undefined| require undefined| requirejs undefined| define undefined| exports undefined| module undefined| bootstrap object| HSFR object| _hsq function| hs_reqwest_0 object| RavenConfig object| WFKVars object| WFMVars object| wp object| Raven object| wfKeys object| jQuery112409863427193900194 object| google_tag_manager string| GoogleAnalyticsObject function| ga string| adroll_adv_id string| adroll_pix_id object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| _paq boolean| _hstc_loaded boolean| __adroll_loaded boolean| _hstc_ran string| __hsUserToken number| expireDateTime string| adroll_sid function| __cmp object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback object| adroll_exp_list boolean| __adroll_consent boolean| __adroll_consent_is_gdpr object| __adroll_consent_data string| __adroll_consent_user_country string| __adroll_consent_adv_country

4 Cookies

Domain/Path Name / Value
.wordfence.com/ Name: __hssc
Value: 151178726.1.1576182832482
.wordfence.com/ Name: __hssrc
Value: 1
.wordfence.com/ Name: hubspotutk
Value: b516b8d42e938216c3e4dd6e7901316f
.wordfence.com/ Name: __hstc
Value: 151178726.b516b8d42e938216c3e4dd6e7901316f.1576182832482.1576182832482.1576182832482.1

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.wordfence.com/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate&ver=5.3(Line 8)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1 ; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d.adroll.com
d.adroll.mgr.consensu.org
fonts.googleapis.com
fonts.gstatic.com
forms.hsforms.com
js.hs-analytics.net
js.hs-scripts.com
js.hsforms.net
maxcdn.bootstrapcdn.com
s.adroll.com
secure.gravatar.com
stats.g.doubleclick.net
track.hubspot.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.wordfence.com
2001:4de0:ac19::1:b:2a
2600:9000:2156:1000:6:6d48:6fc0:93a1
2606:4700::6810:5505
2606:4700::6810:fa05
2606:4700::6811:44b0
2606:4700::6811:ba49
2606:4700::6811:d4cc
2a00:1450:4001:806::2008
2a00:1450:4001:808::200e
2a00:1450:4001:818::2003
2a00:1450:4001:824::200a
2a00:1450:4001:825::2003
2a00:1450:4001:825::2004
2a00:1450:400c:c00::9b
2a04:fa87:fffe::c000:4902
52.215.154.28
72.247.224.172
10a368402e1e0783c47509207e9ebf37baa03d6ceb4314aba95d5bcd0ef36f14
10d8dc6f3a624dd15a719f89c5ffd243575baf446b442731d78987cfe97aa165
11f18af740f9727666190b83a8999d30ade3421e0148bf1b1586eaaad25dd781
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64
18600d985076a482e5b8f07993b3dfe340a515d25a2328b090922c620f7347be
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
2f63cd9333bbcb3708b95c29c01cdb017587972ebc5f49d7063351b2858fa356
387394872cd58f7303cb824544bcaa88ce3144ed3fc2f4dea4f3769e237d164d
396ad48b8a7cd2a2b2107e378bd1f66d15b40b4fb517da2038538e3acad2ae6d
3b6205206b5c515bb685b81ad82ecedf1264a0f1b6b0a99b2d89ce18fe30bc5e
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
48f76f0495fc1c515d7be06e324a852c342ea9fbf2897d8d190d84dfe4c41288
52e9583eff72276651bd501d6643a061dae2e49b9e770b500df0fa66477b449d
58e7874083cadfbbefed6c819fdd8d6c1bfb6ecf7f5ff311bacbcf9a98efd73e
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
64565561ddb338a11ffce5b84aa53fa6e8fd203c34208e61eb5602cd08bf527f
67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7
6bf8036a5299f33867ac6799a454ecca3551be28f5bc1a64566356147270e592
74252b0bdbbec37155b3b0eb4db3fedb4b5b0f0bc26d7315b76f306d44facff5
777ffc53909497266f144583fb49d1b2f8fbe0d115964de18539b80257c9ad25
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ab1aa8ac7913698d8f08727b46b369e4c83102af45da4669ca2d787c243ae49
83581bf3a1c3676d054508897d6f9d756fdd29d74578a03c5095c9b180eb5a8a
8c055f4fc89b73bc480ac07d607782cb3482fc98cbec6f89135ff76ce5512280
94eb062f034d9c0a3631943344065bc2e07d520367312378b596f2b1f2a65109
99730d0c4ecb5c986245fb33c304cd632c959f9c25d91ac49d88f52b817a6c6d
9e70ed29e1b923f467bdef455e745cd6228e2b6404f5647b277bd6cfe4aec2f0
9fd19e4b0367465b629c80d5c1adfad29f9a7351aee7243826d62d18428447d4
a03287087bd08afc2412881bda41c5a46a4f9fb9a603a48c2c619cb86e2b110a
a8885806e666593ea024208a7ba66a0195d7c6252070b501bc00695bbedac513
ad6413f3288018f1d25ada963f8f32a2042f217d85fd15b75a82bc20ca9a7fa0
af6592d435a34ae2cbc384c908b2000e3a33f3c3d7bace1a84ba7880a8a80d9e
b0dcfe7b0cad4d27b5dda5e3d65780191e4e98dac7ef777b3bb3149830fc5a0e
b2dcab60c16edff723e82f94bf91842a4066949a79e417a838e6202c88bb50a7
b51437c45c2be6ce00a55faa767e3773c0b93cc04394fb8ffe57ce59e3d8009e
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
ba178b7d8154fa5ca570a96b6aa9ac806867a6414924e3f714b89ab551e188ed
ba688fb8d66281a3d1803177b25b494a9b63c7f23f0b004ed004de19e228a6bc
bc8c5d879271f87bbb499227284e7ce29713f23f52396444f79126d2c2f185ee
be324f832c99a743be6e9bb6e888e37f1d6ad4e3fb0b9390477a40c2d5d6ce99
c41d674623a722fa0d7e0adeea621208a71b87813c1e09680298c15240853a83
c6f993564578ff62e1c2c45d8ac852c6c1d8e76e92a6d141e5100fc8582a8ff0
c85da21ccf254429d4d87ece4b37d478c96f75817004de6a21fb482199773f7a
ce05c8817b07acc2fda12e14a45a20d35689991a5b0e03be1c58c987e1b2b76f
d1e54f3fe3290ecc4c8474d7bee91ecdb173921702de9a8f127ac28a18bacdcf
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
daa6234745ee9254daffaab8cf80f1d5635c59e61f0d5b2b2cd0e15e627f2880
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
e5b09ae4f391ccd8e04977e2330f1e533a2a507d95c609a3fd437a7ffc7cddfa
e8a7ecf0c7b55d3742a686c4f671351b02d7921b0b8f688080fdaac800f267e3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1e69ff4360cc12fb5c0cf38f19eaa74a2216893fe3cad6936d00fcc49b1bf57
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f980136e6d20acda1b61bbe4b3dbaf38bc685d913b27f7c1b5d474a0591bc7b4