www.harmj0y.net Open in urlscan Pro
104.145.225.3 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.harmj0y.net/blog/redteaming/ghostpack/
Submission: On November 25 via api (November 25th 2019, 4:41:17 pm UTC) from US

Summary HTTP 60 Redirects Links 50 Behaviour Indicators

Summary

This website contacted 11 IPs in 3 countries across 7 domains to perform 60 HTTP transactions. The main IP is 104.145.225.3, located in Piscataway, United States and belongs to AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US. The main domain is www.harmj0y.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 23rd 2019. Valid for: 3 months.

This is the only time www.harmj0y.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
25	104.145.225.3 104.145.225.3	64245 (AS-DIGITA...) (AS-DIGITALFYRE - DigitalFyre Internet Solutions)
1	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
3	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
7	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2606:2800:134... 2606:2800:134:fa2:1627:1fe:edb:1665	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1 2	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER - Twitter Inc.)
15	2606:2800:134... 2606:2800:134:1a0d:1429:742:782:b6	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
60	11

25 104.145.225.3 (Piscataway, United States)

ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US)
PTR: pandora.digitaldatacenter.net

www.harmj0y.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:134:fa2:1627:1fe:edb:1665 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.72 (United States) 1 redirects

ASN13414 (TWITTER - Twitter Inc., US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:134:1a0d:1429:742:782:b6 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

abs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ton.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
25	harmj0y.net www.harmj0y.net	673 KB
16	twimg.com cdn.syndication.twimg.com abs.twimg.com pbs.twimg.com ton.twimg.com	206 KB
9	twitter.com 1 redirects platform.twitter.com syndication.twitter.com	110 KB
4	gravatar.com secure.gravatar.com	10 KB
3	gstatic.com fonts.gstatic.com	28 KB
3	wp.com s0.wp.com stats.wp.com pixel.wp.com	6 KB
1	googleapis.com fonts.googleapis.com	755 B
60	7

	Domain	Requested by
25	www.harmj0y.net	www.harmj0y.net
10	pbs.twimg.com
7	platform.twitter.com	www.harmj0y.net platform.twitter.com
4	secure.gravatar.com	www.harmj0y.net
3	abs.twimg.com
3	fonts.gstatic.com	www.harmj0y.net
2	ton.twimg.com	platform.twitter.com
2	syndication.twitter.com	1 redirects
1	cdn.syndication.twimg.com	platform.twitter.com
1	pixel.wp.com	www.harmj0y.net
1	stats.wp.com	www.harmj0y.net
1	s0.wp.com	www.harmj0y.net
1	fonts.googleapis.com	www.harmj0y.net
60	13

This site contains links to these domains. Also see Links.

Domain
twitter.com
github.com
bloodhoundgang.herokuapp.com
specterops.io
bluescreenofjeff.com
enigma0x3.net
www.invoke-ir.com
wald0.com
v
blogs.msdn.microsoft.com
www.slideshare.net
www.youtube.com
blog.cobaltstrike.com
msdn.microsoft.com
hashcat.net
docs.microsoft.com
medium.com
digitalforensicstips.com
akismet.com
www.competethemes.com

Subject Issuer	Validity	Valid
harmj0y.net cPanel, Inc. Certification Authority	`2019-10-23` - `2020-01-21`	3 months	crt.sh
*.googleapis.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.gravatar.com COMODO RSA Domain Validation Secure Server CA	`2018-09-06` - `2020-09-05`	2 years	crt.sh
*.wp.com Go Daddy Secure Certificate Authority - G2	`2018-04-10` - `2020-05-11`	2 years	crt.sh
*.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://www.harmj0y.net/blog/redteaming/ghostpack/
Frame ID: 3001E6EF54183F1043AD206D883EF782
Requests: 43 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.18ff99b5096ff173368df1a320e00cbf.html?origin=https%3A%2F%2Fwww.harmj0y.net
Frame ID: 94B4F5D1BCD67A2807F8831E16D60261
Requests: 1 HTTP requests in this frame

Frame: https://abs.twimg.com/emoji/v2/72x72/1f95d.png
Frame ID: AB6BADAFD1C1DD63A16404DAB73D3FB8
Requests: 21 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 790D91B0C854E10F562EC65996EDBD91
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

60
Requests

100 %
HTTPS

60 %
IPv6

7
Domains

13
Subdomains

11
IPs

3
Countries

1034 kB
Transfer

1687 kB
Size

0
Cookies

50 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/harmj0y
Title: twitter

Search URL Search Domain Scan URL

URL: https://github.com/harmj0y
Title: github

Search URL Search Domain Scan URL

URL: https://bloodhoundgang.herokuapp.com/
Title: slack

Search URL Search Domain Scan URL

URL: https://specterops.io/

Search URL Search Domain Scan URL

URL: https://bluescreenofjeff.com/
Title: bluescreenofjeff.com

Search URL Search Domain Scan URL

URL: https://enigma0x3.net/
Title: enigma0x3.net

Search URL Search Domain Scan URL

URL: http://www.invoke-ir.com/
Title: invoke-ir.com

Search URL Search Domain Scan URL

URL: https://wald0.com/
Title: wald0.com

Search URL Search Domain Scan URL

URL: https://specterops.io/who-we-are/the-team
Title: SpecterOps

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation
Title: @mattifestation

Search URL Search Domain Scan URL

URL: https://twitter.com/jaredcatkinson
Title: @jaredcatkinson

Search URL Search Domain Scan URL

URL: https://twitter.com/tifkin_
Title: @tifkin_

Search URL Search Domain Scan URL

URL: http://v/
Title: @enigma0x3

Search URL Search Domain Scan URL

URL: https://twitter.com/424f424f
Title: rvrsh3ll

Search URL Search Domain Scan URL

URL: https://twitter.com/xorrior
Title: @xorrior

Search URL Search Domain Scan URL

URL: https://twitter.com/andrewchiles
Title: @andrewchiles

Search URL Search Domain Scan URL

URL: https://github.com/harmj0y/DAMP
Title: rapid prototyping

Search URL Search Domain Scan URL

URL: https://github.com/EmpireProject/Empire
Title: PowerShell Empire

Search URL Search Domain Scan URL

URL: https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell-the-blue-team/
Title: PowerShell ♥ the Blue Team

Search URL Search Domain Scan URL

URL: https://www.slideshare.net/harmj0y/catch-me-if-you-can-powershell-red-vs-blue
Title: Catch Me If You Can: PowerShell Red vs Blue

Search URL Search Domain Scan URL

URL: https://specterops.io/how-we-help/training-offerings/adversary-tactics-powershell
Title: Adversary Tactics: PowerShell

Search URL Search Domain Scan URL

URL: https://github.com/leechristensen/UnmanagedPowerShell
Title: UnmanagedPowerShell

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=BMreZZ1cgFI
Title: in their 2017 DerbyCon keynote

Search URL Search Domain Scan URL

URL: https://blog.cobaltstrike.com/2012/12/05/offense-in-depth/
Title: offense-in-depth

Search URL Search Domain Scan URL

URL: https://twitter.com/subtee
Title: @subtee

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/Seatbelt/
Title: Seatbelt

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/SharpUp/
Title: SharpUp

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/SharpRoast/
Title: SharpRoast

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/SharpDump/
Title: SharpDump

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/SafetyKatz/
Title: SafetyKatz

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/SharpWMI/
Title: SharpWMI

Search URL Search Domain Scan URL

URL: http://github.com/GhostPack/
Title: GhostPack

Search URL Search Domain Scan URL

URL: https://github.com/GhostPack/Seatbelt/blob/master/README.md
Title: README.md

Search URL Search Domain Scan URL

URL: https://github.com/leechristensen/Random/blob/master/PowerShellScripts/Get-HostProfile.ps1
Title: Get-HostProfile.ps1

Search URL Search Domain Scan URL

URL: https://github.com/threatexpress/red-team-scripts/blob/master/HostEnum.ps1
Title: HostEnum.ps1

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/dev/Privesc/PowerUp.ps1
Title: PowerUp

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1#L2574-L2774
Title: PowerView’s Kerberoasting functionality

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.kerberosrequestorsecuritytoken.getrequest(v=vs.110).aspx
Title: KerberosRequestorSecurityToken.GetRequest Method()

Search URL Search Domain Scan URL

URL: https://twitter.com/machosec
Title: @machosec

Search URL Search Domain Scan URL

URL: https://hashcat.net/hashcat/
Title: hashcat

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Out-Minidump.ps1
Title: PowerSploit’s Out-Minidump.ps1

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/desktop/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
Title: MiniDumpWriteDump

Search URL Search Domain Scan URL

URL: https://twitter.com/gentilkiwi
Title: @gentilkiwi

Search URL Search Domain Scan URL

URL: https://github.com/gentilkiwi/mimikatz/
Title: Mimikatz project

Search URL Search Domain Scan URL

URL: https://github.com/re4lity/subTee-gits-backups/blob/master/PELoader.cs
Title: .NET PE loader

Search URL Search Domain Scan URL

URL: https://github.com/tyranid/DotNetToJScript
Title: DotNetToJScript

Search URL Search Domain Scan URL

URL: https://medium.com/@harmj0y/ghostpack-d835018c5fc4
Title: Medium

Search URL Search Domain Scan URL

URL: https://digitalforensicstips.com/2018/09/a-quick-look-at-seatbelt-for-system-enumeration/
Title: A Quick Look at Seatbelt for System Enumeration | Digital Forensics Tips

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://www.competethemes.com/cele/
Title: Cele Theme

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

https://syndication.twitter.com/i/jot HTTP 302
https://platform.twitter.com/jot.html

60 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.harmj0y.net/blog/redteaming/ghostpack/ 168 KB
24 KB 252ms
82ms Document
text/html 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.harmj0y.net/blog/redteaming/ghostpack/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),

Reverse DNS

pandora.digitaldatacenter.net

Software

LiteSpeed / PHP/7.0.33

Resource Hash

a134cbe0a86f4d97876df49214d9f491a83706db15ae454170a01091daf278d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff,nosniff

Request headers

:method: GET
:authority: www.harmj0y.net
:scheme: https
:path: /blog/redteaming/ghostpack/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
x-powered-by: PHP/7.0.33
content-type: text/html; charset=UTF-8
x-pingback: https://www.harmj0y.net/blog/xmlrpc.php
link: <https://www.harmj0y.net/blog/wp-json/>; rel="https://api.w.org/" <https://wp.me/p4qDDn-1bu>; rel=shortlink
etag: "10341-1574673842;gz"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 23849
date: Mon, 25 Nov 2019 16:40:54 GMT
accept-ranges: bytes
server: LiteSpeed
pragma: public
cache-control: public, must-revalidate, proxy-revalidate,public, must-revalidate, proxy-revalidate
x-content-type-options: nosniff,nosniff
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"

GET
H2 200 crayon.min.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
4 KB 84ms
81ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
etag: "4ecc-57328dd4-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 3721
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 classic.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/themes/classic/ 4 KB
734 B 84ms
82ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
etag: "1110-57328dd4-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 672
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 monaco.css
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/ 529 B
273 B 84ms
82ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
etag: "211-57328dd4-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 213
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 style.min.css
www.harmj0y.net/blog/wp-includes/css/dist/block-library/ 25 KB
4 KB 85ms
83ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Thu, 28 Feb 2019 01:26:05 GMT
server: LiteSpeed
etag: "629a-5c7738ad-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 3973
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
755 B 19ms
17ms Stylesheet
text/css 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3

Requested by

Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

45db65d29c8f4c067d9a998aa9216be7b6011a47c8064d564286fd11ef0b3b6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 25 Nov 2019 16:40:56 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 25 Nov 2019 16:40:56 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Mon, 25 Nov 2019 16:40:56 GMT

GET
H2 200 font-awesome.min.css
www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/ 30 KB
7 KB 85ms
83ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/font-awesome.min.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Sun, 14 May 2017 23:35:39 GMT
server: LiteSpeed
etag: "7918-5918e9cb-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 6663
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 style.css
www.harmj0y.net/blog/wp-content/themes/cele/ 34 KB
7 KB 85ms
83ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/themes/cele/style.css?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: dce60247f8fe8382f96de643513d7d0e06af9178c362779050f9e0af90644c2e

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Sun, 14 May 2017 23:35:39 GMT
server: LiteSpeed
etag: "884e-5918e9cb-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 6833
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 default.min.css
www.harmj0y.net/blog/wp-content/plugins/tablepress/css/ 6 KB
3 KB 85ms
83ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/tablepress/css/default.min.css?ver=1.9.2
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Sat, 23 Feb 2019 08:04:25 GMT
server: LiteSpeed
etag: "16ef-5c70fe89-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 2521
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 jetpack.css
www.harmj0y.net/blog/wp-content/plugins/jetpack/css/ 70 KB
12 KB 85ms
84ms Stylesheet
text/css 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/jetpack/css/jetpack.css?ver=7.9.1
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 068e2f18d47e3c6e38eee71beaa5d568af8a7729e5f2be2c4be47eafb4e458de

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Tue, 19 Nov 2019 23:04:45 GMT
server: LiteSpeed
etag: "117db-5dd4750d-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 12108
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 jquery.js Show response
www.harmj0y.net/blog/wp-includes/js/jquery/ 95 KB
32 KB 85ms
84ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Thu, 05 Sep 2019 11:04:55 GMT
server: LiteSpeed
etag: "17a69-5d70ebd7-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 32867
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 jquery-migrate.min.js Show response
www.harmj0y.net/blog/wp-includes/js/jquery/ 10 KB
4 KB 85ms
84ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: LiteSpeed
etag: "2748-573eaa90-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 3826
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 crayon.min.js Show response
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
6 KB 85ms
84ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
etag: "5741-57328dd4-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 6469
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 specterops.png
www.harmj0y.net/blog/wp-content/uploads/2017/07/ 69 KB
66 KB 233ms
232ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.harmj0y.net/blog/wp-content/uploads/2017/07/specterops.png
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: cff92a7eb12d555a40c2c94c90f8b23009c1a7298e15b47d6f7ae6b744fdac15

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Wed, 12 Jul 2017 04:49:36 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 67281
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 12 KB
4 KB 212ms
212ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:54 GMT
content-encoding: br
last-modified: Thu, 28 Feb 2019 01:26:05 GMT
server: LiteSpeed
etag: "2f02-5c7738ad-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 4046
expires: Mon, 02 Dec 2019 16:40:54 GMT

GET
H2 200 seatbelt_system_output-1024x653.png
www.harmj0y.net/blog/wp-content/uploads/2018/07/ 162 KB
159 KB 88ms
86ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.harmj0y.net/blog/wp-content/uploads/2018/07/seatbelt_system_output-1024x653.png
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 4bb3eee0c316b3e2e27bd45c2f7e1b5940f63a1007a36e6847329e8606919f14

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Sun, 22 Jul 2018 00:12:50 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 162331
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 mimikatz_minidump-1024x708.png
www.harmj0y.net/blog/wp-content/uploads/2018/07/ 241 KB
238 KB 88ms
86ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.harmj0y.net/blog/wp-content/uploads/2018/07/mimikatz_minidump-1024x708.png
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: d80b0638877a7093a6a8e1cf6637bcce44143a3ed8cddfbc42fc0489576d9392

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Sat, 21 Jul 2018 22:43:48 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 243381
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 /
secure.gravatar.com/avatar/ 1021 B
1 KB 41ms
14ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/?s=48&d=mm&r=g
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 37a3bd7bc7328f0ead2c0f6f635dddf60615e676e6b4ddf964144012e529de45

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT vie 1
date: Mon, 25 Nov 2019 16:40:56 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
access-control-allow-origin: *
source-age: 12935053
content-type: image/jpeg
status: 200
cache-control: max-age=300
content-disposition: inline; filename="none.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/?s=48&d=mm&r=g>; rel="canonical"
content-length: 1021
expires: Mon, 25 Nov 2019 16:45:56 GMT

GET
H2 200 devicepx-jetpack.js Show response
s0.wp.com/wp-content/js/ 10 KB
3 KB 24ms
5ms Script
application/x-javascript 192.0.77.32
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201948
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Mon, 25 Nov 2019 16:40:56 GMT
content-encoding: gzip
server: nginx
etag: W/"5841a56f-52b6"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
x-ac: 4.fra _dfw
expires: Sun, 22 Nov 2020 04:27:26 GMT

GET
H2 200 gprofiles.js Show response
secure.gravatar.com/js/ 20 KB
7 KB 42ms
13ms Script
application/x-javascript 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/js/gprofiles.js?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:56 GMT
content-encoding: gzip
last-modified: Thu, 23 Aug 2018 15:01:14 GMT
server: nginx
etag: W/"5b7ecc3a-50bc"
content-type: application/x-javascript
status: 200
cache-control: max-age=604800
expires: Mon, 02 Dec 2019 16:40:56 GMT

GET
H2 200 wpgroho.js Show response
www.harmj0y.net/blog/wp-content/plugins/jetpack/modules/ 1 KB
550 B 85ms
82ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/jetpack/modules/wpgroho.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Tue, 19 Nov 2019 23:04:45 GMT
server: LiteSpeed
etag: "42e-5dd4750d-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 443
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 production.min.js Show response
www.harmj0y.net/blog/wp-content/themes/cele/js/build/ 6 KB
2 KB 85ms
83ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/themes/cele/js/build/production.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 703b134857241eccea000989b0435dde381988f53d40119744bff8d1cf828a63

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Sun, 14 May 2017 23:35:39 GMT
server: LiteSpeed
etag: "19c5-5918e9cb-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 2072
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 comment-reply.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 2 KB
1 KB 85ms
83ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/js/comment-reply.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Wed, 13 Mar 2019 03:05:26 GMT
server: LiteSpeed
etag: "8ba-5c887376-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 971
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 twitter-timeline.min.js Show response
www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/ 331 B
261 B 85ms
83ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Tue, 19 Nov 2019 23:04:45 GMT
server: LiteSpeed
etag: "14b-5dd4750d-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 200
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 wp-embed.min.js Show response
www.harmj0y.net/blog/wp-includes/js/ 1 KB
722 B 87ms
86ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-includes/js/wp-embed.min.js?ver=5.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Thu, 13 Dec 2018 03:05:16 GMT
server: LiteSpeed
etag: "57b-5c11cc6c-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 638
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 form.js Show response
www.harmj0y.net/blog/wp-content/plugins/akismet/_inc/ 700 B
360 B 87ms
86ms Script
application/javascript 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/akismet/_inc/form.js?ver=4.1.3
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: public
date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Fri, 01 Nov 2019 07:02:34 GMT
server: LiteSpeed
etag: "2bc-5dbbd88a-0;br"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800,public, must-revalidate, proxy-revalidate
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 251
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 e-201948.js Show response
stats.wp.com/ 9 KB
3 KB 22ms
6ms Script
application/x-javascript 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-201948.js
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:56 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
expires: Sun, 22 Nov 2020 04:27:28 GMT

GET
H2 200 buttons.png
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/ 2 KB
2 KB 152ms
152ms Image
image/png 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/buttons.png
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab

Request headers

Referer: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:55 GMT
content-encoding: br
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 1836
expires: Mon, 02 Dec 2019 16:40:55 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 9ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2

Requested by

Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: https://www.harmj0y.net

Response headers

date: Thu, 21 Nov 2019 20:31:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:37 GMT
server: sffe
age: 331795
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9016
x-xss-protection: 0
expires: Fri, 20 Nov 2020 20:31:01 GMT

GET
H2 200 fontawesome-webfont.woff2
www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/fonts/ 75 KB
76 KB 130ms
128ms Font
font/woff2 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.harmj0y.net/blog/wp-content/themes/cele/assets/font-awesome/css/font-awesome.min.css?ver=5.1.3
Origin: https://www.harmj0y.net

Response headers

date: Mon, 25 Nov 2019 16:40:55 GMT
last-modified: Sun, 14 May 2017 23:35:39 GMT
server: LiteSpeed
content-type: font/woff2
status: 200
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 77160

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: https://www.harmj0y.net

Response headers

date: Thu, 21 Nov 2019 07:11:58 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:44 GMT
server: sffe
age: 379738
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9180
x-xss-protection: 0
expires: Fri, 20 Nov 2020 07:11:58 GMT

GET
H2 200 memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v17/ 10 KB
10 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/memnYaGs126MiZpBA-UFUKWyV9hrIqOxjaPX.woff2

Requested by

Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2C600&subset=latin%2Clatin-ext&ver=5.1.3
Origin: https://www.harmj0y.net

Response headers

date: Wed, 20 Nov 2019 15:22:41 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:56 GMT
server: sffe
age: 436695
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9744
x-xss-protection: 0
expires: Thu, 19 Nov 2020 15:22:41 GMT

GET
H2 200 monaco-webfont.woff
www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/ 21 KB
21 KB 99ms
99ms Font
font/woff 104.145.225.3
DigitalFyre Inter...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/monaco-webfont.woff
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.145.225.3 Piscataway, United States, ASN64245 (AS-DIGITALFYRE - DigitalFyre Internet Solutions, LLC., US),
Reverse DNS: pandora.digitaldatacenter.net
Software: LiteSpeed /
Resource Hash: 9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.harmj0y.net/blog/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Origin: https://www.harmj0y.net

Response headers

date: Mon, 25 Nov 2019 16:40:55 GMT
last-modified: Wed, 11 May 2016 01:41:40 GMT
server: LiteSpeed
content-type: font/woff
status: 200
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 21372

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 7ms
7ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40F7) /
Resource Hash: 0d5d54d040b7904a1980296edc2bb8337e091e2d6e354c5ad5f1b4765a54dd8b

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 25 Nov 2019 16:40:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 22:41:07 GMT
Server: ECS (fcn/40F7)
Etag: "36bfc359950279f61a599a6f5308ee0f+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 28823

GET
H2 200 hovercard.min.css
secure.gravatar.com/dist/css/ 7 KB
2 KB 12ms
12ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/dist/css/hovercard.min.css?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-1a2e"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 02 Dec 2019 16:40:57 GMT

GET
H2 200 services.min.css
secure.gravatar.com/dist/css/ 3 KB
564 B 21ms
21ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.gravatar.com/dist/css/services.min.css?ver=2019Novaa
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
status: 200
cache-control: max-age=604800
expires: Mon, 02 Dec 2019 16:40:57 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 7ms
5ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A7.9.1&blog=65454229&post=4556&tz=-5&srv=www.harmj0y.net&host=www.harmj0y.net&ref=&fcp=637&rand=0.6470564636715563
Requested by: Host: www.harmj0y.net
URL: https://www.harmj0y.net/blog/redteaming/ghostpack/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 25 Nov 2019 16:40:57 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK widget_iframe.18ff99b5096ff173368df1a320e00cbf.html
platform.twitter.com/widgets/ Frame 94B4 0
0 6ms
6ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.18ff99b5096ff173368df1a320e00cbf.html?origin=https%3A%2F%2Fwww.harmj0y.net
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40E2) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Nov 2019 16:40:57 GMT
Etag: "7d3f6ed140174a20e7c8be261a70a863+gzip"
Last-Modified: Tue, 19 Nov 2019 21:57:05 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40E2)
Vary: Accept-Encoding
X-Cache: HIT
Content-Length: 5816

GET
H/1.1 200
OK moment~timeline~tweet.59ba92add9619cbea83259c6b2945d58.js Show response
platform.twitter.com/js/ 24 KB
8 KB 7ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/moment~timeline~tweet.59ba92add9619cbea83259c6b2945d58.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40EA) /
Resource Hash: a668f312587c201e6fe0c86a47dac99bbdb64a69b7c762fcd5f5824baed59e25

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 25 Nov 2019 16:40:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 21:56:57 GMT
Server: ECS (fcn/40EA)
Etag: "1af2e0f1f2aad913565977962695eb79+gzip"
Vary: Accept-Encoding
ACCESS-CONTROL-ALLOW-METHODS: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7911

GET
H/1.1 200
OK timeline.c3517e16d45be2dd27ebd0de26e70c9d.js Show response
platform.twitter.com/js/ 23 KB
7 KB 12ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/timeline.c3517e16d45be2dd27ebd0de26e70c9d.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40FB) /
Resource Hash: 3d2f1ff5dcd234ce4c39c3c76842e4badca89ba69f2bf4efad81be95eaaf4d12

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 25 Nov 2019 16:40:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 21:56:57 GMT
Server: ECS (fcn/40FB)
Etag: "dfef22f18ec5b77bd20915a1571b5335+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Content-Length: 7037

GET
H2 200 profile Show response
cdn.syndication.twimg.com/timeline/ 39 KB
6 KB 44ms
25ms Script
application/javascript 2606:2800:134:fa2:1627:1fe:edb:1665
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_harmj0y_old&dnt=false&domain=www.harmj0y.net&lang=en&screen_name=harmj0y&suppress_response_codes=true&t=1749666&tweet_limit=5&tz=GMT%2B0100&with_replies=false

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (lcy/1D57) /

Resource Hash

8335e1772b8eb511ab6641b198f3a8bf6932fb2846641fb9c6d546e91304a735

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-disposition: attachment; filename=jsonp.jsonp
strict-transport-security: max-age=631138519
content-length: 5826
x-xss-protection: 0
x-response-time: 153
last-modified: Mon, 25 Nov 2019 16:40:22 GMT
server: ECS (lcy/1D57)
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: must-revalidate, max-age=300
x-connection-hash: 309b0cda38a034350886c97eedf283a5
accept-ranges: bytes
timing-allow-origin: *
x-transaction: 005a2a4700a93ead
expires: Mon, 25 Nov 2019 16:45:57 GMT

GET
H2 200 syndication
syndication.twitter.com/i/jot/ 43 B
337 B 118ms
117ms Image
image/gif 104.244.42.72
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/syndication?l=%7B%22_category_%22%3A%22syndicated_impression%22%2C%22triggered_on%22%3A1574700057376%2C%22dnt%22%3Afalse%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22timeline%22%2C%22action%22%3A%22impression%22%7D%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Mon, 25 Nov 2019 16:40:57 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 0957bd0c70d6f2e86566a4f8d31e1313
x-transaction: 00bb8dd00070ae95
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 1f95d.png
abs.twimg.com/emoji/v2/72x72/ Frame AB6B 1 KB
2 KB 26ms
6ms Image
image/png 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/1f95d.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40B3) /

Resource Hash

38ac85ed26d241632e416fe8a7462f479c7c3e8bfdf184ddb2025fc6835f5f46

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-ton-expected-size: 1339
x-cache: HIT
status: 200
content-length: 1339
x-response-time: 9
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:30:38 GMT
server: ECS (fcn/40B3)
etag: "ApQvsLi65r9Ifadcjgmxhg=="
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
x-connection-hash: 4cdaf3ce578b3f93b881931a765eb94a
accept-ranges: bytes
expires: Tue, 24 Nov 2020 16:40:57 GMT

GET
H2 200 cQI9mE6n
pbs.twimg.com/card_img/1197237891648409605/ Frame AB6B 23 KB
23 KB 27ms
8ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1197237891648409605/cQI9mE6n?format=jpg&name=600x314

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/419F) /

Resource Hash

a0e84e3625abbd6f7b1c7b0b244161212ac9c09822c5bd165b68e92588ee5a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 23355
x-response-time: 158
surrogate-key: card_img card_img/bucket/6 card_img/1197237891648409605
last-modified: Wed, 20 Nov 2019 19:36:51 GMT
server: ECS (fcn/419F)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2c6db49dfa5608023b42ca232a785cd1
accept-ranges: bytes

GET
H2 200 2620.png
abs.twimg.com/emoji/v2/72x72/ Frame AB6B 936 B
1 KB 26ms
6ms Image
image/png 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/2620.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4190) /

Resource Hash

15bd815441d05ea3c5e905b5de384be076810413b69127d14c8f426ed178634e

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-ton-expected-size: 936
x-cache: HIT
status: 200
content-length: 936
x-response-time: 25
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:30:42 GMT
server: ECS (fcn/4190)
etag: "XWEnjXsBXkPOoHXQt8QJDw=="
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
x-connection-hash: 9ce4643806dfb776ea8ed4a6931d7855
accept-ranges: bytes
expires: Tue, 24 Nov 2020 16:40:57 GMT

GET
H2 200 1f5a5.png
abs.twimg.com/emoji/v2/72x72/ Frame AB6B 290 B
423 B 26ms
7ms Image
image/png 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://abs.twimg.com/emoji/v2/72x72/1f5a5.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40DB) /

Resource Hash

f954e6bc9a8dfa00d02bd8bb94eef2d2934a0ff4cc318575eb0d541f9371db16

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-ton-expected-size: 290
x-cache: HIT
status: 200
content-length: 290
x-response-time: 17
surrogate-key: twitter-assets
last-modified: Wed, 21 Feb 2018 22:30:28 GMT
server: ECS (fcn/40DB)
etag: "5nMruWR2t1Zfu+p+iGG72w=="
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
x-connection-hash: ed7d9075485dc64e2d9ac69a289df13c
accept-ranges: bytes
expires: Tue, 24 Nov 2020 16:40:57 GMT

GET
H/1.1 200
OK timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ Frame AB6B 52 KB
12 KB 7ms
6ms Stylesheet
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/css/timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: 12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 25 Nov 2019 16:40:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 21:56:53 GMT
Server: ECS (fcn/4187)
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H/1.1 200
OK timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
platform.twitter.com/css/ 52 KB
52 KB 6ms
6ms Image
text/css 2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform.twitter.com/css/timeline.a4ac5782325ad1b5e51c8b06daf47853.light.ltr.css
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 25 Nov 2019 16:40:57 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 21:56:53 GMT
Server: ECS (fcn/4187)
Etag: "0100ec69a2c00683a1ae89e074b822c1+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Content-Type: text/css; charset=utf-8
Content-Length: 12155

GET
H2 200 3NILFaXQ_normal.png
pbs.twimg.com/profile_images/1140290718482817025/ Frame AB6B 6 KB
6 KB 7ms
5ms Image
image/png 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1140290718482817025/3NILFaXQ_normal.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40D7) /

Resource Hash

35c3663c2ab72cdb53c1efa1e12e1a28985bad360340e75f9aceaa2efd420459

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 5911
x-response-time: 135
surrogate-key: profile_images profile_images/bucket/8 profile_images/1140290718482817025
last-modified: Sun, 16 Jun 2019 16:09:07 GMT
server: ECS (fcn/40D7)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: f447ff02226509ba64fe5819f43bfc64
accept-ranges: bytes

GET
H2 200 dG9Y4RhK_normal.jpg
pbs.twimg.com/profile_images/883033419827032065/ Frame AB6B 2 KB
2 KB 8ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/883033419827032065/dG9Y4RhK_normal.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4193) /

Resource Hash

2192a8a11b3b0968c13f8933c5fdb91355f5584681429d76567cdbd4eda32fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2263
x-response-time: 128
surrogate-key: profile_images profile_images/bucket/8 profile_images/883033419827032065
last-modified: Thu, 06 Jul 2017 18:40:27 GMT
server: ECS (fcn/4193)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: a1eed2549862c88ec3915378f86dfce9
accept-ranges: bytes

GET
H2 200 juH7dpuG_normal.jpg
pbs.twimg.com/profile_images/969653533988462592/ Frame AB6B 2 KB
2 KB 8ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/969653533988462592/juH7dpuG_normal.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A8) /

Resource Hash

ade8e5ad3e6f0678d71186fd23bd7b33cf4e50e46bc6b857405c7c1453d10b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2111
x-response-time: 192
surrogate-key: profile_images profile_images/bucket/4 profile_images/969653533988462592
last-modified: Fri, 02 Mar 2018 19:17:52 GMT
server: ECS (fcn/41A8)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: e1753b62d3e5751c83c75f359d40a0e2
accept-ranges: bytes

GET
H2 200 oq0KZS7N_normal.jpg
pbs.twimg.com/profile_images/996342484404985856/ Frame AB6B 2 KB
2 KB 8ms
7ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/996342484404985856/oq0KZS7N_normal.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/4192) /

Resource Hash

ea602e3d9e87bcd7e368fdb7931ee6e21bf15d167c977f8922e095a7b4d8b462

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2263
x-response-time: 206
surrogate-key: profile_images profile_images/bucket/2 profile_images/996342484404985856
last-modified: Tue, 15 May 2018 10:50:14 GMT
server: ECS (fcn/4192)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2c1579634a6a30ac579334813c86389e
accept-ranges: bytes

GET
H2 200 mbpjFna1_normal.jpg
pbs.twimg.com/profile_images/1073707305479430146/ Frame AB6B 3 KB
3 KB 14ms
13ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1073707305479430146/mbpjFna1_normal.jpg

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/41A5) /

Resource Hash

3835e87aa7a113fe31da91ab01a4551c67f81dbb9388e392ec180008b9089730

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 2643
x-response-time: 109
surrogate-key: profile_images profile_images/bucket/3 profile_images/1073707305479430146
last-modified: Fri, 14 Dec 2018 22:30:24 GMT
server: ECS (fcn/41A5)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: fc232c548cc3bcd5123872a25b67bd96
accept-ranges: bytes

GET
H2 200 EKLxMexXUAACXVm
pbs.twimg.com/media/ Frame AB6B 54 KB
55 KB 9ms
8ms Image
image/png 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EKLxMexXUAACXVm?format=png&name=360x360

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40E4) /

Resource Hash

b32d4282e49cba493e4927d44256cc32f4d7fcc9c29796f71c3fe19025c39bc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 55742
x-response-time: 207
surrogate-key: media media/bucket/8 media/1198785647554809856
last-modified: Mon, 25 Nov 2019 02:07:05 GMT
server: ECS (fcn/40E4)
strict-transport-security: max-age=631138519
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: c15ee48dec799e9a9c06387c182ed013
accept-ranges: bytes

GET
H2 200 EJgDEsZWwAEUiJK
pbs.twimg.com/media/ Frame AB6B 17 KB
18 KB 8ms
8ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EJgDEsZWwAEUiJK?format=jpg&name=360x360

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40E8) /

Resource Hash

9b911e3051e85c4347d221b2c1c53dbc7b9e5f88b29abb86bb17202b73d56fa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 17913
x-response-time: 180
surrogate-key: media media/bucket/8 media/1195709080238735361
last-modified: Sat, 16 Nov 2019 14:21:54 GMT
server: ECS (fcn/40E8)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2ffa044bf65ea9f7bd200e714a7bf12d
accept-ranges: bytes

GET
H2 200 EJWOkUOXsAAt0pD
pbs.twimg.com/media/ Frame AB6B 12 KB
12 KB 14ms
13ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/media/EJWOkUOXsAAt0pD?format=jpg&name=360x360

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/40DE) /

Resource Hash

d78dc6a399d0d09f280d9d10f7367b1a2cca36b85fc31433d85e7508dc720cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 12571
x-response-time: 166
surrogate-key: media media/bucket/7 media/1195018030692151296
last-modified: Thu, 14 Nov 2019 16:35:55 GMT
server: ECS (fcn/40DE)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 16bf72a7720decab787a93bd6d6f971a
accept-ranges: bytes

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame AB6B 44 KB
7 KB 9ms
7ms Stylesheet
text/css 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
strict-transport-security: max-age=631138519
content-length: 6839
x-response-time: 9
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-connection-hash: 9c0d8fa061b77fed428d7a93eb9e4afa
accept-ranges: bytes
expires: Mon, 02 Dec 2019 16:40:57 GMT

GET
H2 200 syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ 44 KB
44 KB 14ms
13ms Image
text/css 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/418C) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-ton-expected-size: 45170
x-cache: HIT
status: 200
strict-transport-security: max-age=631138519
content-length: 6839
x-response-time: 9
surrogate-key: tfw
last-modified: Tue, 14 May 2019 18:53:54 GMT
server: ECS (fcn/418C)
etag: "4mhImCFS9rptiUICNnLD1g=="
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-connection-hash: 9c0d8fa061b77fed428d7a93eb9e4afa
accept-ranges: bytes
expires: Mon, 02 Dec 2019 16:40:57 GMT

GET
DATA 200
OK truncated
/ Frame AB6B 512 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame AB6B 825 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame AB6B 739 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame AB6B 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame AB6B 572 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ Frame AB6B 644 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 cQI9mE6n
pbs.twimg.com/card_img/1197237891648409605/ Frame AB6B 23 KB
23 KB 6ms
6ms Image
image/jpeg 2606:2800:134:1a0d:1429:742:782:b6
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1197237891648409605/cQI9mE6n?format=jpg&name=600x314

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),

Reverse DNS

Software

ECS (fcn/419F) /

Resource Hash

a0e84e3625abbd6f7b1c7b0b244161212ac9c09822c5bd165b68e92588ee5a2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.harmj0y.net/blog/redteaming/ghostpack/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 25 Nov 2019 16:40:57 GMT
x-content-type-options: nosniff
x-cache: HIT
status: 200
content-length: 23355
x-response-time: 158
surrogate-key: card_img card_img/bucket/6 card_img/1197237891648409605
last-modified: Wed, 20 Nov 2019 19:36:51 GMT
server: ECS (fcn/419F)
strict-transport-security: max-age=631138519
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
x-connection-hash: 2c6db49dfa5608023b42ca232a785cd1
accept-ranges: bytes

GET
H/1.1

200
OK

jot.html
platform.twitter.com/ Frame 790D
Redirect Chain

https://syndication.twitter.com/i/jot
https://platform.twitter.com/jot.html

0
0

7ms
6ms

Document
text/html

2606:2800:234:46c:e8b:1e2f:2bd:694
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/jot.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECS (fcn/40B6) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://www.harmj0y.net
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Accept-Ranges: bytes
ACCESS-CONTROL-ALLOW-METHODS: GET
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Mon, 25 Nov 2019 16:40:58 GMT
Etag: "d9592a6c704736fa4da218d4357976dd"
Last-Modified: Tue, 19 Nov 2019 22:41:07 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40B6)
X-Cache: HIT
Content-Length: 80

Redirect headers

status: 302 302 Found
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
content-type: text/html;charset=utf-8
date: Mon, 25 Nov 2019 16:40:57 GMT
expires: Tue, 31 Mar 1981 05:00:00 GMT
last-modified: Mon, 25 Nov 2019 16:40:57 GMT
location: https://platform.twitter.com/jot.html
pragma: no-cache
server: tsa_o
strict-transport-security: max-age=631138519
x-connection-hash: 0957bd0c70d6f2e86566a4f8d31e1313
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 105
x-transaction: 0004613200aa95f7
x-tsa-request-body-time: 0
x-twitter-response-tags: BouncerCompliant
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.harmj0y.net/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff,nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abs.twimg.com
cdn.syndication.twimg.com
fonts.googleapis.com
fonts.gstatic.com
pbs.twimg.com
pixel.wp.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
stats.wp.com
syndication.twitter.com
ton.twimg.com
www.harmj0y.net
104.145.225.3
104.244.42.72
192.0.76.3
192.0.77.32
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:234:46c:e8b:1e2f:2bd:694
2a00:1450:4001:809::2003
2a00:1450:4001:825::200a
2a04:fa87:fffe::c000:4902
01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
068e2f18d47e3c6e38eee71beaa5d568af8a7729e5f2be2c4be47eafb4e458de
0d5d54d040b7904a1980296edc2bb8337e091e2d6e354c5ad5f1b4765a54dd8b
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
12bf529a0f4d0a3f10d003a07d5b91e40579a3da18022a9896a9ccd9e5dc1b33
15bd815441d05ea3c5e905b5de384be076810413b69127d14c8f426ed178634e
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
2192a8a11b3b0968c13f8933c5fdb91355f5584681429d76567cdbd4eda32fed
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
35c3663c2ab72cdb53c1efa1e12e1a28985bad360340e75f9aceaa2efd420459
37a3bd7bc7328f0ead2c0f6f635dddf60615e676e6b4ddf964144012e529de45
3835e87aa7a113fe31da91ab01a4551c67f81dbb9388e392ec180008b9089730
38ac85ed26d241632e416fe8a7462f479c7c3e8bfdf184ddb2025fc6835f5f46
3d2f1ff5dcd234ce4c39c3c76842e4badca89ba69f2bf4efad81be95eaaf4d12
41c93545a4e2a1a46bca581d80fec8c8da014e13b310c65d694e4af30c7da9bd
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
45db65d29c8f4c067d9a998aa9216be7b6011a47c8064d564286fd11ef0b3b6e
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4bb3eee0c316b3e2e27bd45c2f7e1b5940f63a1007a36e6847329e8606919f14
4ed07f590bdfa9aa775dbfdef617d98e1e972d102d4289c7a68d3bd9118c280b
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab
703b134857241eccea000989b0435dde381988f53d40119744bff8d1cf828a63
760bc4d420605c167dd90147b0e0d82b4e761a18bc35be7aeffaa4192b371635
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7b5e32cb325e9aaef357a421cd16ddf6d6ddb70fec74b6c35a73eccc6817664c
8335e1772b8eb511ab6641b198f3a8bf6932fb2846641fb9c6d546e91304a735
8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f
9b911e3051e85c4347d221b2c1c53dbc7b9e5f88b29abb86bb17202b73d56fa1
9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567
9c42615b9f87888a452f177c5ea19899fb8a835b8f6d0b458824e6c332a0adce
a0e84e3625abbd6f7b1c7b0b244161212ac9c09822c5bd165b68e92588ee5a2b
a134cbe0a86f4d97876df49214d9f491a83706db15ae454170a01091daf278d0
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a668f312587c201e6fe0c86a47dac99bbdb64a69b7c762fcd5f5824baed59e25
a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756
a87f4fd815fc95288f2da6efc536c950ef940bd9eb52176fd9e8e56107cc65e2
abd2a457215e60ab60b2a6b4f25a17583c5d80e13935f76e097236f729c5dcd6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ade8e5ad3e6f0678d71186fd23bd7b33cf4e50e46bc6b857405c7c1453d10b34
b32d4282e49cba493e4927d44256cc32f4d7fcc9c29796f71c3fe19025c39bc9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
c1cfa5c2bce904bfc524754a954d2e062c703777ab704134dc5f619dca1e40af
c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c
cff92a7eb12d555a40c2c94c90f8b23009c1a7298e15b47d6f7ae6b744fdac15
d78dc6a399d0d09f280d9d10f7367b1a2cca36b85fc31433d85e7508dc720cde
d80b0638877a7093a6a8e1cf6637bcce44143a3ed8cddfbc42fc0489576d9392
dce60247f8fe8382f96de643513d7d0e06af9178c362779050f9e0af90644c2e
ded16b9cb72df85ea242aaef8878c716abb57c746f0bfda6eabd2b9ddb2a23b5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ea602e3d9e87bcd7e368fdb7931ee6e21bf15d167c977f8922e095a7b4d8b462
eddfb285df91d818926b2f8ec64c71be82e0ea4f21ca9f63f5b0bc5dbcd75b0b
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f954e6bc9a8dfa00d02bd8bb94eef2d2934a0ff4cc318575eb0d541f9371db16

www.harmj0y.net Open in urlscan Pro 104.145.225.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

60 Requests

100 %HTTPS

60 %IPv6

7 Domains

13 Subdomains

11 IPs

3 Countries

1034 kBTransfer

1687 kBSize

0 Cookies

50 Outgoing links

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.harmj0y.net Open in urlscan Pro
104.145.225.3 Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

100 %
HTTPS

60 %
IPv6

7
Domains

13
Subdomains

11
IPs

3
Countries

1034 kB
Transfer

1687 kB
Size

0
Cookies

60 HTTP transactions
6 data transactions