www.active-directory-security.com Open in urlscan Pro
2a00:1450:4001:81c::2013 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Submission: On November 25 via manual (November 25th 2017, 11:47:06 pm UTC) from US

Summary HTTP 63 Redirects Links 74 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 8 domains to perform 63 HTTP transactions. The main IP is 2a00:1450:4001:81c::2013, located in Ireland and belongs to GOOGLE - Google LLC, US. The main domain is www.active-directory-security.com.

This is the only time www.active-directory-security.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	2a00:1450:400... 2a00:1450:4001:81c::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
17	2a00:1450:400... 2a00:1450:4001:81c::2009	15169 (GOOGLE) (GOOGLE - Google LLC)
34	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1	97.74.249.31 97.74.249.31	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
3	2a00:1450:400... 2a00:1450:4001:81c::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	148.253.246.70 148.253.246.70	36408 (CDNETWORK...) (CDNETWORKSUS-02 - CDNetworks Inc.)
1	104.20.3.47 104.20.3.47	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
63	8

3 2a00:1450:4001:81c::2013 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.active-directory-security.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:81c::2009 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.blogger.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
resources.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img1.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img2.blogblog.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2a00:1450:4001:81c::2001 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

1.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
2.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
3.bp.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
lh6.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 97.74.249.31 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-97-74-249-31.ip.secureserver.net

www.paramountdefenses.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.253.246.70 (United States)

ASN36408 (CDNETWORKSUS-02 - CDNetworks Inc., US)

www.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.3.47 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	blogspot.com 1.bp.blogspot.com 4.bp.blogspot.com 2.bp.blogspot.com 3.bp.blogspot.com	1 MB
10	blogblog.com resources.blogblog.com www.blogblog.com img1.blogblog.com img2.blogblog.com	4 KB
7	blogger.com www.blogger.com	195 KB
3	google.com apis.google.com accounts.google.com Failed	87 KB
3	active-directory-security.com www.active-directory-security.com	33 KB
2	statcounter.com www.statcounter.com c.statcounter.com	10 KB
1	googleusercontent.com lh6.googleusercontent.com	711 B
1	paramountdefenses.com www.paramountdefenses.com	3 KB
63	8

	Domain	Requested by
10	2.bp.blogspot.com	www.active-directory-security.com
10	1.bp.blogspot.com	www.active-directory-security.com
8	4.bp.blogspot.com	www.active-directory-security.com
7	www.blogger.com	www.active-directory-security.com www.blogger.com
5	3.bp.blogspot.com	www.active-directory-security.com
4	img1.blogblog.com	www.active-directory-security.com
4	resources.blogblog.com	www.active-directory-security.com
3	apis.google.com	www.active-directory-security.com apis.google.com
3	www.active-directory-security.com	www.active-directory-security.com www.blogger.com
1	lh6.googleusercontent.com
1	c.statcounter.com	www.active-directory-security.com
1	www.statcounter.com	www.active-directory-security.com
1	img2.blogblog.com	www.active-directory-security.com
1	www.paramountdefenses.com	www.active-directory-security.com
1	www.blogblog.com	www.active-directory-security.com
0	accounts.google.com Failed	apis.google.com
63	16

This site contains links to these domains. Also see Links.

Domain
www.paramountdefenses.com
www.sanjaytandon.com
www.blogger.com
adsecurity.org
www.cyber-security-blog.com
1.bp.blogspot.com
4.bp.blogspot.com
2.bp.blogspot.com
technet.microsoft.com
3.bp.blogspot.com
www.netwrix.com
www.netvibes.com
add.my.yahoo.com
www.identitysecurityandaccessblog.com

Subject Issuer	Validity	Valid
*.blogger.com Google Internet Authority G3	`2017-11-01` - `2018-01-24`	3 months	crt.sh
*.googleusercontent.com Google Internet Authority G2	`2017-11-01` - `2018-01-24`	3 months	crt.sh
*.apis.google.com Google Internet Authority G3	`2017-11-01` - `2018-01-24`	3 months	crt.sh

This page contains 4 frames:

Primary Page: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Frame ID: 16648.1
Requests: 60 HTTP requests in this frame

Frame: https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047&bpli=1
Frame ID: 16648.2
Requests: 1 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&source=blogger%3Ablog%3Aplusone&size=medium&width=300&annotation=inline&hl=en&origin=http%3A%2F%2Fwww.active-directory-security.com&url=http%3A%2F%2Fwww.active-directory-security.com%2F2016%2F08%2Factive-directory-credential-theft-mimikatz-dcsync-mitigation.html&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.AH3ReJsExgM.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw
Frame ID: 16648.3
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fwww.active-directory-security.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.AH3ReJsExgM.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw
Frame ID: 16648.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Blogger (Blogs) Expand

Overall confidence: 100%
Detected patterns

meta generator /^Blogger$/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

Page Statistics

63
Requests

75 %
HTTPS

57 %
IPv6

8
Domains

16
Subdomains

8
IPs

2
Countries

1639 kB
Transfer

2359 kB
Size

4
Cookies

74 Outgoing links

These are links going to different origins than the main page.

URL: http://www.paramountdefenses.com/goldfinger
Title: Gold Finger

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/insight
Title: The Paramount Brief

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/goldfinger_mini
Title: Gold Finger Mini

Search URL Search Domain Scan URL

URL: http://www.sanjaytandon.com/peace
Title: World Peace

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=HTML&widgetId=HTML4&action=editWidget&sectionId=crosscol
Title:

Search URL Search Domain Scan URL

URL: https://adsecurity.org/?p=1729
Title: this

Search URL Search Domain Scan URL

URL: http://www.cyber-security-blog.com/2016/08/how-to-lockdown-active-Directory-to-thwart-use-of-mimikatz-dcsync.html
Title: How to Lockdown Active Directory to Thwart the Use of Mimikatz DCSync

Search URL Search Domain Scan URL

URL: https://adsecurity.org/?page_id=1821
Title: Mimikatz

Search URL Search Domain Scan URL

URL: http://www.cyber-security-blog.com/2016/07/a-letter-to-benjamin-delpy-re-mimikatz-and-active-directory-security.html
Title: Benjamin Delpy

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/s1600/Intruder.jpg

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-8biggB2LHt4/V5GjztHYLbI/AAAAAAAAB1U/XPI7BgZDTds562bVBs5IYFo1aN2FzMBwQCLcB/s1600/hacker-is-now-admin.jpg

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-HGhdYJe7KfA/V5MubQLYllI/AAAAAAAAB4g/x59hZLxDRwE-O6Jx173JTZwSPrSu4x-PwCLcB/s1600/Logon-Denied.jpg

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-wY7pCzoSsxA/V5Ml7VfZyFI/AAAAAAAAB3s/fZQV1mFjC0ExgJbWcPHnHYg67nVk-JKmgCLcB/s1600/Active-Directory-Replication.jpg

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-PfQXRH21jXM/V5Gvq1Q5eAI/AAAAAAAAB1k/JKxmwywZcVQmIGsXz78O9OVykNPnG9KnQCLcB/s1600/Replicating-Directory-Changes-All.png

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/cc772673(v=ws.10).aspx
Title: Appendix D

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/cc773318(v=ws.10).aspx
Title: whitepaper

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-IVGccGlTC1k/V5MtllU5k_I/AAAAAAAAB4U/OzWAdji989QzhzWKe1ltRXOEyGIdc7PFQCLcB/s1600/Lockdown.jpg

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-jocfUq8WN5E/V5MtG1uAf6I/AAAAAAAAB4Q/CgUoBD3kVWAW86qsPD8fuOOSWFRSpbP2ACLcB/s1600/Active-Directory-Delegated-Administrators.jpg

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/active-directory-security/effective-permissions.html
Title: effective permissions

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-khzLvevlCFo/V5G6LuszOlI/AAAAAAAAB10/HZTjex7NL2ovN3etzbKAfzu9gGxxZkC4gCLcB/s1600/The-Effective-Permissions-Tab.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-mE5C4PWtrKI/V5G6dX0u2UI/AAAAAAAAB14/g74o_XrJee8-NtdZ6qLq8FLfhmFnO7RDACLcB/s1600/Security-Principal-Selector.png

Search URL Search Domain Scan URL

URL: http://www.netwrix.com/netwrix_effective_permissions_reporting_tool.html
Title: this

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2I/86Rhavfc57o5tUpRS0fSsrtWjLeu9JFXQCLcB/s1600/Active-Directory-Effective-Permissions-Tool.png

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/active-directory-effective-permissions-tool.html
Title: Active Directory Effective Permissions Tool

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2M/XT8FkCG7_oonySohlXEg79TlJaIvezJSgCEw/s1600/Active-Directory-Effective-Permissions-Tool.png

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-IoKc6TwvCqg/V5HI0Ui4H1I/AAAAAAAAB2g/FmiTTu8841Me2MU6gRc9zNs3psMb0MYIQCLcB/s1600/AD-Effective-Permissions-Tool.png

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/resources/misc/Effective-Permissions-on-domain-root-PRE-Hardening.csv
Title: here

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-IvGc3Zclie4/V5HIKJiSPJI/AAAAAAAAB2c/9xfXsNesg-snU0HBmZRlcxHmCq1ZVt5WACEw/s1600/Microsoft-Active-Directory-Effective-Permissions-Tool.png

Search URL Search Domain Scan URL

URL: https://1.bp.blogspot.com/-U04GGLT32rY/V5HKFwx03SI/AAAAAAAAB2s/8m8mTQTsAW4s1ve9dJESkISbfhFmm2ozACLcB/s1600/Access-Rights-in-Active-Directory.png

Search URL Search Domain Scan URL

URL: https://4.bp.blogspot.com/-nz9QoPQVAxQ/V5HKi79L2RI/AAAAAAAAB2w/Lvh5zRTp87Id1XAuj_NQ03HSeD3By9RsQCLcB/s1600/Access-Rights-in-Active-Directory-Revoked.png

Search URL Search Domain Scan URL

URL: https://3.bp.blogspot.com/-Za9gvrkHqV4/V5HK-96hmfI/AAAAAAAAB24/_-ca8_eablsdBE7wkAosi5g-Hh1AID4OACLcB/s1600/Effective-Permissions-Post-Lockdown.png

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/resources/misc/Effective-Permissions-on-domain-root-POST-Hardening.csv
Title: here

Search URL Search Domain Scan URL

URL: https://2.bp.blogspot.com/-aqrFXhnv_5E/V5Moox9MMsI/AAAAAAAAB34/57L4KQThjS0x8CgIqZjQRIHm_bX-xatrACLcB/s1600/One-Additional-User.jpg

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/leadership.html
Title: Sanjay

Search URL Search Domain Scan URL

URL: https://www.blogger.com/share-post.g?blogID=5958499117721089763&postID=9170327295752271703&target=email
Title: Email This

Search URL Search Domain Scan URL

URL: https://www.blogger.com/share-post.g?blogID=5958499117721089763&postID=9170327295752271703&target=blog
Title: BlogThis!

Search URL Search Domain Scan URL

URL: https://www.blogger.com/share-post.g?blogID=5958499117721089763&postID=9170327295752271703&target=twitter
Title: Share to Twitter

Search URL Search Domain Scan URL

URL: https://www.blogger.com/share-post.g?blogID=5958499117721089763&postID=9170327295752271703&target=facebook
Title: Share to Facebook

Search URL Search Domain Scan URL

URL: https://www.blogger.com/share-post.g?blogID=5958499117721089763&postID=9170327295752271703&target=pinterest
Title: Share to Pinterest

Search URL Search Domain Scan URL

URL: https://www.blogger.com/email-post.g?blogID=5958499117721089763&postID=9170327295752271703
Title:

Search URL Search Domain Scan URL

URL: https://www.blogger.com/post-edit.g?blogID=5958499117721089763&postID=9170327295752271703&from=pencil
Title:

Search URL Search Domain Scan URL

URL: https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047

Search URL Search Domain Scan URL

URL: https://www.blogger.com/blog-this.g
Title: Create a Link

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Image&widgetId=Image1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Text&widgetId=Text1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/defending-active-directory-against-cyberattacks.html
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Image&widgetId=Image4&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.cyber-security-blog.com/
Title: Cyber Security Blog

Search URL Search Domain Scan URL

URL: http://www.cyber-security-blog.com/2017/10/a-massive-cyber-breach-whilst-considering-the-cloud.html
Title: A Massive Cyber Breach at a Company Whilst it was Considering the 'Cloud'

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=BlogList&widgetId=BlogList1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=FeaturedPost&widgetId=FeaturedPost1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=BlogSearch&widgetId=BlogSearch1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: https://www.netvibes.com/subscribe.php?url=http%3A%2F%2Fwww.active-directory-security.com%2Ffeeds%2Fposts%2Fdefault
Title:

Search URL Search Domain Scan URL

URL: https://add.my.yahoo.com/content?url=http%3A%2F%2Fwww.active-directory-security.com%2Ffeeds%2Fposts%2Fdefault
Title:

Search URL Search Domain Scan URL

URL: https://www.netvibes.com/subscribe.php?url=http%3A%2F%2Fwww.active-directory-security.com%2Ffeeds%2F9170327295752271703%2Fcomments%2Fdefault
Title:

Search URL Search Domain Scan URL

URL: https://add.my.yahoo.com/content?url=http%3A%2F%2Fwww.active-directory-security.com%2Ffeeds%2F9170327295752271703%2Fcomments%2Fdefault
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Subscribe&widgetId=Subscribe1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/cyber-security/privileged-access.html
Title: Active Directory Privileged Access

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/goldfinger.html
Title: ---

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/active-directory-security/tools.html
Title: Top 10 Active Directory Audit Tools (e.g. dsacls, LDP, Gold Finger etc.)

Search URL Search Domain Scan URL

URL: http://www.paramountdefenses.com/privileged-access-insight.html
Title: ---

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=LinkList&widgetId=LinkList1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=PopularPosts&widgetId=PopularPosts1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=BlogArchive&widgetId=BlogArchive1&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Label&widgetId=Label2&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.identitysecurityandaccessblog.com/2011/05/rules-of-engagement.html
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Image&widgetId=Image3&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.sanjaytandon.com/
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Image&widgetId=Image2&action=editWidget&sectionId=sidebar-right-1
Title:

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=HTML&widgetId=HTML1&action=editWidget&sectionId=footer-1
Title:

Search URL Search Domain Scan URL

URL: https://www.blogger.com/
Title: Blogger

Search URL Search Domain Scan URL

URL: http://www.blogger.com/rearrange?blogID=5958499117721089763&widgetType=Attribution&widgetId=Attribution1&action=editWidget&sectionId=footer-3
Title:

Search URL Search Domain Scan URL

URL: https://www.blogger.com/go/blogspot-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047 HTTP 302
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D5958499117721089763%26postID%3D9170327295752271703%26blogspotRpcToken%3D947047%26bpli%3D1&followup=https://www.blogger.com/comment-iframe.g?blogID%3D5958499117721089763%26postID%3D9170327295752271703%26blogspotRpcToken%3D947047%26bpli%3D1&passive=true&go=true HTTP 302
https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047&bpli=1

63 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request active-directory-credential-theft-mimikatz-dcsync-mitigation.html Show response
www.active-directory-security.com/2016/08/ 162 KB
30 KB 552ms
547ms Document
text/html 2a00:1450:4001:81c::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2013 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

2d60410dcba5d2b798539797bff5c8f81c69305e1a6c78035f512ed535b75f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.active-directory-security.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Nov 2017 22:46:32 GMT
Server: GSE
ETag: W/"535362b8ebaac7cc2399e097c72d3f56a4438d47adf0c8cb6d5efc74abec3a2b"
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=0
Content-Length: 31051
X-XSS-Protection: 1; mode=block
Expires: Sat, 25 Nov 2017 23:46:54 GMT

GET
H2 200 3213516723-css_bundle_v2.css
www.blogger.com/static/v1/widgets/ 41 KB
9 KB 35ms
12ms Stylesheet
text/css 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

630e4fd46a40c9983b7e8dcdee9366f5f7a921e8dc6882281dfced08b5744858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/widgets/3213516723-css_bundle_v2.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 05:48:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Nov 2017 17:38:27 GMT
server: sffe
age: 1447111
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 9140
x-xss-protection: 1; mode=block
expires: Fri, 09 Nov 2018 05:48:23 GMT

GET
H2 200 icon18_wrench_allbkg.png
resources.blogblog.com/img/ 475 B
484 B 36ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/icon18_wrench_allbkg.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: resources.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 20:18:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 22 Nov 2017 03:45:43 GMT
server: sffe
age: 271675
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 475
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 20:18:59 GMT

GET
H2 200 Intruder.jpg
1.bp.blogspot.com/-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/s640/ 22 KB
22 KB 304ms
273ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/s640/Intruder.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d911c89b6ebb23dc1e5b3374b1423722560d2d4bc0270b0e3c246d332658f820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/s640/Intruder.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Intruder.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 22932
x-xss-protection: 1; mode=block
server: fife
etag: "v782"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 hacker-is-now-admin.jpg
1.bp.blogspot.com/-8biggB2LHt4/V5GjztHYLbI/AAAAAAAAB1U/XPI7BgZDTds562bVBs5IYFo1aN2FzMBwQCLcB/s640/ 62 KB
62 KB 240ms
210ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-8biggB2LHt4/V5GjztHYLbI/AAAAAAAAB1U/XPI7BgZDTds562bVBs5IYFo1aN2FzMBwQCLcB/s640/hacker-is-now-admin.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

7b317a98d6ed147189a2796700b5723991e017d8f370352f1afe00c8321e70f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-8biggB2LHt4/V5GjztHYLbI/AAAAAAAAB1U/XPI7BgZDTds562bVBs5IYFo1aN2FzMBwQCLcB/s640/hacker-is-now-admin.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="hacker-is-now-admin.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 63838
x-xss-protection: 1; mode=block
server: fife
etag: "v756"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 authorization.css
www.blogger.com/dyn-css/ 1 B
39 B 112ms
111ms Stylesheet
text/css 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5958499117721089763&zx=f1838253-98c7-439e-95bc-4cb9d0aedf46

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /dyn-css/authorization.css?targetBlogID=5958499117721089763&zx=f1838253-98c7-439e-95bc-4cb9d0aedf46
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 21
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 25 Nov 2017 23:46:54 GMT
server: GSE
date: Sat, 25 Nov 2017 23:46:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=UTF-8
cache-control: private, max-age=1800
expires: Sat, 25 Nov 2017 23:46:54 GMT

GET
H2 200 Logon-Denied.jpg
4.bp.blogspot.com/-HGhdYJe7KfA/V5MubQLYllI/AAAAAAAAB4g/x59hZLxDRwE-O6Jx173JTZwSPrSu4x-PwCLcB/s640/ 44 KB
44 KB 219ms
189ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-HGhdYJe7KfA/V5MubQLYllI/AAAAAAAAB4g/x59hZLxDRwE-O6Jx173JTZwSPrSu4x-PwCLcB/s640/Logon-Denied.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

bfeab86d6f6f08ef1929dcd1df932d1103e35c4f6afa75becbaaf776007e3084

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-HGhdYJe7KfA/V5MubQLYllI/AAAAAAAAB4g/x59hZLxDRwE-O6Jx173JTZwSPrSu4x-PwCLcB/s640/Logon-Denied.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Logon-Denied.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 44663
x-xss-protection: 1; mode=block
server: fife
etag: "v78b"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory-Replication.jpg
1.bp.blogspot.com/-wY7pCzoSsxA/V5Ml7VfZyFI/AAAAAAAAB3s/fZQV1mFjC0ExgJbWcPHnHYg67nVk-JKmgCLcB/s640/ 44 KB
44 KB 237ms
207ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-wY7pCzoSsxA/V5Ml7VfZyFI/AAAAAAAAB3s/fZQV1mFjC0ExgJbWcPHnHYg67nVk-JKmgCLcB/s640/Active-Directory-Replication.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

b9bf378dcddc62e35d7cccdb1ab76e96e8e47b67dedf269d175ae66b5ed501e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-wY7pCzoSsxA/V5Ml7VfZyFI/AAAAAAAAB3s/fZQV1mFjC0ExgJbWcPHnHYg67nVk-JKmgCLcB/s640/Active-Directory-Replication.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Replication.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 45119
x-xss-protection: 1; mode=block
server: fife
etag: "v77d"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Replicating-Directory-Changes-All.png
2.bp.blogspot.com/-PfQXRH21jXM/V5Gvq1Q5eAI/AAAAAAAAB1k/JKxmwywZcVQmIGsXz78O9OVykNPnG9KnQCLcB/s1600/ 26 KB
26 KB 338ms
308ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-PfQXRH21jXM/V5Gvq1Q5eAI/AAAAAAAAB1k/JKxmwywZcVQmIGsXz78O9OVykNPnG9KnQCLcB/s1600/Replicating-Directory-Changes-All.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

6a1dfbb61a63a55cc6579c6dc42f3b42b54fd577b6eb44d728bf96d3611711a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-PfQXRH21jXM/V5Gvq1Q5eAI/AAAAAAAAB1k/JKxmwywZcVQmIGsXz78O9OVykNPnG9KnQCLcB/s1600/Replicating-Directory-Changes-All.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Replicating-Directory-Changes-All.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26633
x-xss-protection: 1; mode=block
server: fife
etag: "v75a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Lockdown.jpg
3.bp.blogspot.com/-IVGccGlTC1k/V5MtllU5k_I/AAAAAAAAB4U/OzWAdji989QzhzWKe1ltRXOEyGIdc7PFQCLcB/s640/ 32 KB
32 KB 197ms
166ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-IVGccGlTC1k/V5MtllU5k_I/AAAAAAAAB4U/OzWAdji989QzhzWKe1ltRXOEyGIdc7PFQCLcB/s640/Lockdown.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

dc951757d4534238bf3c44d30753b14af10dff3275cdd0c39156f8b0191c28cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-IVGccGlTC1k/V5MtllU5k_I/AAAAAAAAB4U/OzWAdji989QzhzWKe1ltRXOEyGIdc7PFQCLcB/s640/Lockdown.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:54 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Lockdown.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 33203
x-xss-protection: 1; mode=block
server: fife
etag: "v789"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:54 GMT

GET
H/1.1 200
OK pattern.gif
4.bp.blogspot.com/-3WmebbFEHoY/TnuhQSDJd1I/AAAAAAAAAEE/E4HQsJvsuTs/s1600/ 1 KB
1 KB 229ms
224ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://4.bp.blogspot.com/-3WmebbFEHoY/TnuhQSDJd1I/AAAAAAAAAEE/E4HQsJvsuTs/s1600/pattern.gif

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

faf4225a56eda333692afb59c102d23609feb191c1fdee20e0a1f56a0ad998be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
X-Content-Type-Options: nosniff
Server: fife
ETag: "v41"
Vary: Origin
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="pattern.png"
Timing-Allow-Origin: *
Content-Length: 1091
X-XSS-Protection: 1; mode=block
Expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H/1.1 200
OK tabs_gradient_light.png
www.blogblog.com/1kt/awesomeinc/ 182 B
182 B 12ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.blogblog.com/1kt/awesomeinc/tabs_gradient_light.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5e516df49b160c3efcb1ea09dd4c5f5b7c99a23a18a2a882acc379179bdbaacd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.blogblog.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Wed, 22 Nov 2017 14:22:22 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Nov 2017 23:57:37 GMT
Server: sffe
Age: 293072
Content-Type: image/png
Cache-Control: public, max-age=604800
Accept-Ranges: bytes
Content-Length: 182
X-XSS-Protection: 1; mode=block
Expires: Wed, 29 Nov 2017 14:22:22 GMT

GET
H2 200 Active-Directory-Delegated-Administrators.jpg
1.bp.blogspot.com/-jocfUq8WN5E/V5MtG1uAf6I/AAAAAAAAB4Q/CgUoBD3kVWAW86qsPD8fuOOSWFRSpbP2ACLcB/s640/ 32 KB
32 KB 233ms
232ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-jocfUq8WN5E/V5MtG1uAf6I/AAAAAAAAB4Q/CgUoBD3kVWAW86qsPD8fuOOSWFRSpbP2ACLcB/s640/Active-Directory-Delegated-Administrators.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

c9dbbd812944f90742d69c10481ef9860b4dc061d8ca07a5fd16d3766f802cd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-jocfUq8WN5E/V5MtG1uAf6I/AAAAAAAAB4Q/CgUoBD3kVWAW86qsPD8fuOOSWFRSpbP2ACLcB/s640/Active-Directory-Delegated-Administrators.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Delegated-Administrators.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 32536
x-xss-protection: 1; mode=block
server: fife
etag: "v786"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 The-Effective-Permissions-Tab.png
2.bp.blogspot.com/-khzLvevlCFo/V5G6LuszOlI/AAAAAAAAB10/HZTjex7NL2ovN3etzbKAfzu9gGxxZkC4gCLcB/s640/ 21 KB
21 KB 275ms
274ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-khzLvevlCFo/V5G6LuszOlI/AAAAAAAAB10/HZTjex7NL2ovN3etzbKAfzu9gGxxZkC4gCLcB/s640/The-Effective-Permissions-Tab.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

5216a57fe09f61f0d4cda3faf38c089c5119d4c9e4b37184af58f2db81a8b64c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-khzLvevlCFo/V5G6LuszOlI/AAAAAAAAB10/HZTjex7NL2ovN3etzbKAfzu9gGxxZkC4gCLcB/s640/The-Effective-Permissions-Tab.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="The-Effective-Permissions-Tab.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 21152
x-xss-protection: 1; mode=block
server: fife
etag: "v75f"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Security-Principal-Selector.png
2.bp.blogspot.com/-mE5C4PWtrKI/V5G6dX0u2UI/AAAAAAAAB14/g74o_XrJee8-NtdZ6qLq8FLfhmFnO7RDACLcB/s1600/ 11 KB
11 KB 289ms
287ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-mE5C4PWtrKI/V5G6dX0u2UI/AAAAAAAAB14/g74o_XrJee8-NtdZ6qLq8FLfhmFnO7RDACLcB/s1600/Security-Principal-Selector.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

a15dc2e70162366548e23c843a4e71d900eb70c1ebbab995bbe736377e309c6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-mE5C4PWtrKI/V5G6dX0u2UI/AAAAAAAAB14/g74o_XrJee8-NtdZ6qLq8FLfhmFnO7RDACLcB/s1600/Security-Principal-Selector.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Security-Principal-Selector.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 11161
x-xss-protection: 1; mode=block
server: fife
etag: "v761"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory-Effective-Permissions-Tool.png
1.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2I/86Rhavfc57o5tUpRS0fSsrtWjLeu9JFXQCLcB/s640/ 152 KB
152 KB 294ms
293ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2I/86Rhavfc57o5tUpRS0fSsrtWjLeu9JFXQCLcB/s640/Active-Directory-Effective-Permissions-Tool.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

1dc360481ba7d2fe26ea02b529a81438595b8ddd4999ddcd54e05bf443aa79e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2I/86Rhavfc57o5tUpRS0fSsrtWjLeu9JFXQCLcB/s640/Active-Directory-Effective-Permissions-Tool.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Effective-Permissions-Tool.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 155735
x-xss-protection: 1; mode=block
server: fife
etag: "v763"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory-Effective-Permissions-Tool.png
2.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2M/XT8FkCG7_oonySohlXEg79TlJaIvezJSgCEw/s640/ 152 KB
152 KB 294ms
293ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2M/XT8FkCG7_oonySohlXEg79TlJaIvezJSgCEw/s640/Active-Directory-Effective-Permissions-Tool.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

1dc360481ba7d2fe26ea02b529a81438595b8ddd4999ddcd54e05bf443aa79e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-zAbWb7MHca8/V5G87EBx8eI/AAAAAAAAB2M/XT8FkCG7_oonySohlXEg79TlJaIvezJSgCEw/s640/Active-Directory-Effective-Permissions-Tool.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Effective-Permissions-Tool.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 155735
x-xss-protection: 1; mode=block
server: fife
etag: "v763"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 AD-Effective-Permissions-Tool.png
2.bp.blogspot.com/-IoKc6TwvCqg/V5HI0Ui4H1I/AAAAAAAAB2g/FmiTTu8841Me2MU6gRc9zNs3psMb0MYIQCLcB/s640/ 153 KB
153 KB 368ms
367ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-IoKc6TwvCqg/V5HI0Ui4H1I/AAAAAAAAB2g/FmiTTu8841Me2MU6gRc9zNs3psMb0MYIQCLcB/s640/AD-Effective-Permissions-Tool.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

46d60abc7ad000a1b4e0ce09cefabbc63e2d25f8e4e052855eb971e673e09781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-IoKc6TwvCqg/V5HI0Ui4H1I/AAAAAAAAB2g/FmiTTu8841Me2MU6gRc9zNs3psMb0MYIQCLcB/s640/AD-Effective-Permissions-Tool.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="AD-Effective-Permissions-Tool.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 157073
x-xss-protection: 1; mode=block
server: fife
etag: "v769"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Microsoft-Active-Directory-Effective-Permissions-Tool.png
2.bp.blogspot.com/-IvGc3Zclie4/V5HIKJiSPJI/AAAAAAAAB2c/9xfXsNesg-snU0HBmZRlcxHmCq1ZVt5WACEw/s640/ 149 KB
149 KB 420ms
420ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-IvGc3Zclie4/V5HIKJiSPJI/AAAAAAAAB2c/9xfXsNesg-snU0HBmZRlcxHmCq1ZVt5WACEw/s640/Microsoft-Active-Directory-Effective-Permissions-Tool.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

25d8978f8abed212a301ac5e66d22150d02f0d30e683c0c66ac45129e742cbef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-IvGc3Zclie4/V5HIKJiSPJI/AAAAAAAAB2c/9xfXsNesg-snU0HBmZRlcxHmCq1ZVt5WACEw/s640/Microsoft-Active-Directory-Effective-Permissions-Tool.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Microsoft-Active-Directory-Effective-Permissions-Tool.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 152958
x-xss-protection: 1; mode=block
server: fife
etag: "v767"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Access-Rights-in-Active-Directory.png
1.bp.blogspot.com/-U04GGLT32rY/V5HKFwx03SI/AAAAAAAAB2s/8m8mTQTsAW4s1ve9dJESkISbfhFmm2ozACLcB/s1600/ 26 KB
26 KB 346ms
345ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-U04GGLT32rY/V5HKFwx03SI/AAAAAAAAB2s/8m8mTQTsAW4s1ve9dJESkISbfhFmm2ozACLcB/s1600/Access-Rights-in-Active-Directory.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

6cff6c1642641adfa31e159d5f29b48fd96eebb4a75b873ea18e3bea7742aeff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-U04GGLT32rY/V5HKFwx03SI/AAAAAAAAB2s/8m8mTQTsAW4s1ve9dJESkISbfhFmm2ozACLcB/s1600/Access-Rights-in-Active-Directory.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Access-Rights-in-Active-Directory.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26365
x-xss-protection: 1; mode=block
server: fife
etag: "v76d"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Access-Rights-in-Active-Directory-Revoked.png
4.bp.blogspot.com/-nz9QoPQVAxQ/V5HKi79L2RI/AAAAAAAAB2w/Lvh5zRTp87Id1XAuj_NQ03HSeD3By9RsQCLcB/s1600/ 27 KB
27 KB 274ms
274ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-nz9QoPQVAxQ/V5HKi79L2RI/AAAAAAAAB2w/Lvh5zRTp87Id1XAuj_NQ03HSeD3By9RsQCLcB/s1600/Access-Rights-in-Active-Directory-Revoked.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

0d06215aa81f24b6a8add8513a214e27243bd0107ce54f11217f15183189ba58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-nz9QoPQVAxQ/V5HKi79L2RI/AAAAAAAAB2w/Lvh5zRTp87Id1XAuj_NQ03HSeD3By9RsQCLcB/s1600/Access-Rights-in-Active-Directory-Revoked.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Access-Rights-in-Active-Directory-Revoked.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27758
x-xss-protection: 1; mode=block
server: fife
etag: "v770"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Effective-Permissions-Post-Lockdown.png
3.bp.blogspot.com/-Za9gvrkHqV4/V5HK-96hmfI/AAAAAAAAB24/_-ca8_eablsdBE7wkAosi5g-Hh1AID4OACLcB/s640/ 135 KB
135 KB 286ms
286ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-Za9gvrkHqV4/V5HK-96hmfI/AAAAAAAAB24/_-ca8_eablsdBE7wkAosi5g-Hh1AID4OACLcB/s640/Effective-Permissions-Post-Lockdown.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

b841b5283ae3e5ced1658ed7d61a45bed8ece32d667ec4b15f823088a7b11ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-Za9gvrkHqV4/V5HK-96hmfI/AAAAAAAAB24/_-ca8_eablsdBE7wkAosi5g-Hh1AID4OACLcB/s640/Effective-Permissions-Post-Lockdown.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Effective-Permissions-Post-Lockdown.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 138342
x-xss-protection: 1; mode=block
server: fife
etag: "v770"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 One-Additional-User.jpg
2.bp.blogspot.com/-aqrFXhnv_5E/V5Moox9MMsI/AAAAAAAAB34/57L4KQThjS0x8CgIqZjQRIHm_bX-xatrACLcB/s640/ 25 KB
25 KB 297ms
296ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-aqrFXhnv_5E/V5Moox9MMsI/AAAAAAAAB34/57L4KQThjS0x8CgIqZjQRIHm_bX-xatrACLcB/s640/One-Additional-User.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

4bedbdc4f556abcc2df916e9b60b1d489ec97f1bb1638c0e703b69cc8f403de9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-aqrFXhnv_5E/V5Moox9MMsI/AAAAAAAAB34/57L4KQThjS0x8CgIqZjQRIHm_bX-xatrACLcB/s640/One-Additional-User.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="One-Additional-User.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25589
x-xss-protection: 1; mode=block
server: fife
etag: "v780"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H/1.1 200
OK icon18_email.gif
img1.blogblog.com/img/ 164 B
164 B 12ms
6ms Image
image/gif 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://img1.blogblog.com/img/icon18_email.gif

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

1258cbe1e2900ec3df11a83a6bb6008d7a833f783a6df80b0d5d45a052ac1466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: img1.blogblog.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Wed, 22 Nov 2017 14:43:20 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Nov 2017 22:40:18 GMT
Server: sffe
Age: 291815
Content-Type: image/gif
Cache-Control: public, max-age=604800
Accept-Ranges: bytes
Content-Length: 164
X-XSS-Protection: 1; mode=block
Expires: Wed, 29 Nov 2017 14:43:20 GMT

GET
H2 200 icon18_edit_allbkg.gif
resources.blogblog.com/img/ 162 B
171 B 6ms
6ms Image
image/gif 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/icon18_edit_allbkg.gif

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/icon18_edit_allbkg.gif
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: resources.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Fri, 24 Nov 2017 10:29:31 GMT
x-content-type-options: nosniff
last-modified: Thu, 23 Nov 2017 16:55:48 GMT
server: sffe
age: 134243
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 162
x-xss-protection: 1; mode=block
expires: Fri, 01 Dec 2017 10:29:31 GMT

GET
H2 200 1930376684-comment_from_post_iframe.js Show response
www.blogger.com/static/v1/jsbin/ 11 KB
4 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/jsbin/1930376684-comment_from_post_iframe.js

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

540f4b7abbcbb4ac5591d0074a696a22c8c8ff679e491a96bc05545c0600d4ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/jsbin/1930376684-comment_from_post_iframe.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Fri, 17 Nov 2017 01:31:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 17 Nov 2017 00:59:39 GMT
server: sffe
age: 771330
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4408
x-xss-protection: 1; mode=block
expires: Sat, 17 Nov 2018 01:31:24 GMT

GET
H/1.1 200
OK PD_Logo_White_Background.jpg
3.bp.blogspot.com/-fXztlZnTnqc/URwzzLQIaRI/AAAAAAAAAt4/UMSm2CHsWM8/s250/ 13 KB
13 KB 22ms
16ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://3.bp.blogspot.com/-fXztlZnTnqc/URwzzLQIaRI/AAAAAAAAAt4/UMSm2CHsWM8/s250/PD_Logo_White_Background.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

39c61a14b0560db7fed76a5f11ba672d5c337648374f0ed5a37cf97f8a96f790

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 3.bp.blogspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:54 GMT
X-Content-Type-Options: nosniff
Server: fife
ETag: "v2de"
Vary: Origin
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="PD_Logo_White_Background.jpg"
Timing-Allow-Origin: *
Content-Length: 13256
X-XSS-Protection: 1; mode=block
Expires: Sun, 26 Nov 2017 23:46:54 GMT

GET
H/1.1 200
OK msft_logo
www.paramountdefenses.com/images/ 3 KB
3 KB 1426ms
1214ms Image
image/jpeg 97.74.249.31
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.paramountdefenses.com/images/msft_logo
Requested by: Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Protocol: HTTP/1.1
Server: 97.74.249.31 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-97-74-249-31.ip.secureserver.net
Software: Apache /
Resource Hash: 7249cd37017e0d4c8b034563a6e7f356af978956ae451679d8882a123bad88a4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.paramountdefenses.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
Last-Modified: Thu, 22 Jan 2015 08:12:12 GMT
Server: Apache
ETag: "cf2-50d393aa8ef00;55b614e910ff2"
Vary: negotiate
Content-Type: image/jpeg
Cache-Control: max-age=5184000
TCN: choice
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Location: msft_logo.jpg
Keep-Alive: timeout=5, max=100
Content-Length: 3314
Expires: Wed, 24 Jan 2018 23:46:55 GMT

GET
H/1.1 200
OK Active-Directory-Security-Presentation.png
4.bp.blogspot.com/-UDVLZZRVUQU/WBARtrZD9XI/AAAAAAAAB-E/8aU5Fl7kbU0aSYaZY7KOgFNZkCQz6cvbwCK4B/s1600/ 26 KB
26 KB 22ms
16ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://4.bp.blogspot.com/-UDVLZZRVUQU/WBARtrZD9XI/AAAAAAAAB-E/8aU5Fl7kbU0aSYaZY7KOgFNZkCQz6cvbwCK4B/s1600/Active-Directory-Security-Presentation.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

5574e422712ea196228bc980107312471c8236ab861d65f77e8536d8d60cfbc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 4.bp.blogspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:54 GMT
X-Content-Type-Options: nosniff
Server: fife
ETag: "v7e2"
Vary: Origin
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="Active-Directory-Security-Presentation.png"
Timing-Allow-Origin: *
Content-Length: 26973
X-XSS-Protection: 1; mode=block
Expires: Sun, 26 Nov 2017 23:46:54 GMT

GET
H2 200 Board-of-Directors.jpg
2.bp.blogspot.com/-bhB0ng9NRKw/WK4aiHo4NtI/AAAAAAAACP8/CYEmTodqqpQPGqJ5dzfdsPnbmyFCRTrFgCPcBGAYYCw/s72-c/ 4 KB
4 KB 16ms
15ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-bhB0ng9NRKw/WK4aiHo4NtI/AAAAAAAACP8/CYEmTodqqpQPGqJ5dzfdsPnbmyFCRTrFgCPcBGAYYCw/s72-c/Board-of-Directors.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d83f6f8ac2b827bb36e6a5a81cd4209f25ad22d52df316db88025a57568c14fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-bhB0ng9NRKw/WK4aiHo4NtI/AAAAAAAACP8/CYEmTodqqpQPGqJ5dzfdsPnbmyFCRTrFgCPcBGAYYCw/s72-c/Board-of-Directors.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Board-of-Directors.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4147
x-xss-protection: 1; mode=block
server: fife
etag: "v8ff"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory.jpg
4.bp.blogspot.com/-Vw-7VN5AlyE/WcPivRacJgI/AAAAAAAAC8Q/8LvuixKgDRsIvVHB87vRYOLeZKExG5JmwCLcBGAs/s1600/ 88 KB
88 KB 20ms
20ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-Vw-7VN5AlyE/WcPivRacJgI/AAAAAAAAC8Q/8LvuixKgDRsIvVHB87vRYOLeZKExG5JmwCLcBGAs/s1600/Active-Directory.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

51e21df2b04a48d231a3a734d8ea1a8be6f8c417fd666c1aa8839c9c0278ca0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-Vw-7VN5AlyE/WcPivRacJgI/AAAAAAAAC8Q/8LvuixKgDRsIvVHB87vRYOLeZKExG5JmwCLcBGAs/s1600/Active-Directory.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
age: 0
status: 200
content-disposition: inline;filename="Active-Directory.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 89809
x-xss-protection: 1; mode=block
server: fife
etag: "vbc5"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Mon, 20 Nov 2017 22:22:05 GMT

GET
H2 200 arrow_dropdown.gif
img2.blogblog.com/img/widgets/ 141 B
150 B 7ms
6ms Image
image/gif 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img2.blogblog.com/img/widgets/arrow_dropdown.gif

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

28ab89f0285c48d2faed701905c185c302f2b389584a52ceaa76a91ea64dc3a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/widgets/arrow_dropdown.gif
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img2.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:40:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 17:42:09 GMT
server: sffe
age: 291992
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 141
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:40:23 GMT

GET
H2 200 icon_feed12.png
img1.blogblog.com/img/ 500 B
509 B 6ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img1.blogblog.com/img/icon_feed12.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3cd341f37642f8a58b0fe14c2645913449c0ffe10be6ba0986275bfef29bc319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/icon_feed12.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img1.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:24:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 19:46:25 GMT
server: sffe
age: 292974
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 500
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:24:01 GMT

GET
H2 200 subscribe-netvibes.png
img1.blogblog.com/img/widgets/ 1 KB
1 KB 6ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img1.blogblog.com/img/widgets/subscribe-netvibes.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

71b8ad79c680b3e5d452a792c3b418b23f739a0a34005e0f37ec674f4c78cb5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/widgets/subscribe-netvibes.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img1.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:48:08 GMT
x-content-type-options: nosniff
last-modified: Wed, 22 Nov 2017 10:30:51 GMT
server: sffe
age: 291527
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1445
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:48:08 GMT

GET
H2 200 subscribe-yahoo.png
img1.blogblog.com/img/widgets/ 580 B
589 B 6ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img1.blogblog.com/img/widgets/subscribe-yahoo.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

bbf9b924cc32bff4738bb54d86905476349f90c8b20f748633e56f64379d553e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/widgets/subscribe-yahoo.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: img1.blogblog.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:36:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 17:42:09 GMT
server: sffe
age: 292217
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 580
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:36:38 GMT

GET
H2 200 LDP.png
2.bp.blogspot.com/-pazC2pXhoQQ/V2XyzzpDgbI/AAAAAAAABWs/pbzpAhRUaMAQi94qWRp_X5n6CqrEcxCqQCLcB/w72-h72-p-k-no-nu/ 6 KB
6 KB 18ms
17ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-pazC2pXhoQQ/V2XyzzpDgbI/AAAAAAAABWs/pbzpAhRUaMAQi94qWRp_X5n6CqrEcxCqQCLcB/w72-h72-p-k-no-nu/LDP.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

1928823b789f045c0c54eaf50e3203b40daca9918226530651d4b262964b7932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-pazC2pXhoQQ/V2XyzzpDgbI/AAAAAAAABWs/pbzpAhRUaMAQi94qWRp_X5n6CqrEcxCqQCLcB/w72-h72-p-k-no-nu/LDP.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="LDP.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 6488
x-xss-protection: 1; mode=block
server: fife
etag: "v56e"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 MaxTokenSize.png
4.bp.blogspot.com/-BtI37fOBJJk/U4UIbucxJsI/AAAAAAAAAsE/3bEXkkt-Ah0/w72-h72-p-k-no-nu/ 4 KB
4 KB 16ms
16ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-BtI37fOBJJk/U4UIbucxJsI/AAAAAAAAAsE/3bEXkkt-Ah0/w72-h72-p-k-no-nu/MaxTokenSize.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

6f58ab7ea31a499e1956c5cceeb0ee864e9b67bf4737d25f0b47961478b63f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-BtI37fOBJJk/U4UIbucxJsI/AAAAAAAAAsE/3bEXkkt-Ah0/w72-h72-p-k-no-nu/MaxTokenSize.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="MaxTokenSize.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4121
x-xss-protection: 1; mode=block
server: fife
etag: "v2c2"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory-Security-Risks.png
4.bp.blogspot.com/--awsL2v4g_8/WURCnvx_uhI/AAAAAAAACWI/VOl6NzhDdV415DV1OgVnDzX8nekrBgTfACPcBGAYYCw/w72-h72-p-k-no-nu/ 3 KB
3 KB 16ms
16ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/--awsL2v4g_8/WURCnvx_uhI/AAAAAAAACWI/VOl6NzhDdV415DV1OgVnDzX8nekrBgTfACPcBGAYYCw/w72-h72-p-k-no-nu/Active-Directory-Security-Risks.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

6b9b8ab0ce6401bf12dcfbe31f2fd2b24dce47bfb18c67cba6101c4323e3bdfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /--awsL2v4g_8/WURCnvx_uhI/AAAAAAAACWI/VOl6NzhDdV415DV1OgVnDzX8nekrBgTfACPcBGAYYCw/w72-h72-p-k-no-nu/Active-Directory-Security-Risks.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Security-Risks.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 2800
x-xss-protection: 1; mode=block
server: fife
etag: "v962"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Hacker.jpg
2.bp.blogspot.com/-HS1y8Tecrpo/WU19pIIr9vI/AAAAAAAACdc/Q5J2YZ4IvP4LVYe-MYPm7_rDb_IjCXWQACLcBGAs/w72-h72-p-k-no-nu/ 3 KB
3 KB 15ms
15ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://2.bp.blogspot.com/-HS1y8Tecrpo/WU19pIIr9vI/AAAAAAAACdc/Q5J2YZ4IvP4LVYe-MYPm7_rDb_IjCXWQACLcBGAs/w72-h72-p-k-no-nu/Hacker.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

f70e6f049afbfe7161dfd6da14e30fcee1babdb3976fd0ec3d924b5d5846b0b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-HS1y8Tecrpo/WU19pIIr9vI/AAAAAAAACdc/Q5J2YZ4IvP4LVYe-MYPm7_rDb_IjCXWQACLcBGAs/w72-h72-p-k-no-nu/Hacker.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 2.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Hacker.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 2890
x-xss-protection: 1; mode=block
server: fife
etag: "v9d8"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Microsoft.jpg
3.bp.blogspot.com/-3bLtQxJ7gxo/WK4ZDl6GH4I/AAAAAAAACPY/wrk1FHUvQXUQ8wE3bifMy9CM6XuRXkEEQCLcB/w72-h72-p-k-no-nu/ 4 KB
4 KB 17ms
17ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-3bLtQxJ7gxo/WK4ZDl6GH4I/AAAAAAAACPY/wrk1FHUvQXUQ8wE3bifMy9CM6XuRXkEEQCLcB/w72-h72-p-k-no-nu/Microsoft.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

c4ece62f522d87c0b7989d999296fe6026b8e0dd1a40ade26090901982214648

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-3bLtQxJ7gxo/WK4ZDl6GH4I/AAAAAAAACPY/wrk1FHUvQXUQ8wE3bifMy9CM6XuRXkEEQCLcB/w72-h72-p-k-no-nu/Microsoft.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Microsoft.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4426
x-xss-protection: 1; mode=block
server: fife
etag: "v8fd"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Active-Directory.png
4.bp.blogspot.com/-iuf3gQGEWTw/WUhnHvVQOpI/AAAAAAAACZY/rUvwgpdJGnY2FCGhphlYQAR-9kcs0fblgCLcBGAs/w72-h72-p-k-no-nu/ 11 KB
11 KB 16ms
16ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://4.bp.blogspot.com/-iuf3gQGEWTw/WUhnHvVQOpI/AAAAAAAACZY/rUvwgpdJGnY2FCGhphlYQAR-9kcs0fblgCLcBGAs/w72-h72-p-k-no-nu/Active-Directory.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

e8c887fbb469aa8d8e7e375a9685d9c5ef3768e0575d29ca384cb8817a6c4d4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-iuf3gQGEWTw/WUhnHvVQOpI/AAAAAAAACZY/rUvwgpdJGnY2FCGhphlYQAR-9kcs0fblgCLcBGAs/w72-h72-p-k-no-nu/Active-Directory.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 4.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 11494
x-xss-protection: 1; mode=block
server: fife
etag: "v997"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 Intruder.jpg
1.bp.blogspot.com/-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/w72-h72-p-k-no-nu/ 2 KB
2 KB 23ms
23ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/w72-h72-p-k-no-nu/Intruder.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

3e6950a8f9b9593e0eea3aaafff50991970cdff280d3118446fce0673334dcaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-D6qWyuEwXnA/V5MqJjijwrI/AAAAAAAAB4E/GxKO4wm5PqEhIduzEPDhHgfYSokIVqlfgCLcB/w72-h72-p-k-no-nu/Intruder.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:54 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Intruder.jpg"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1604
x-xss-protection: 1; mode=block
server: fife
etag: "v782"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:54 GMT

GET
H2 200 Active-Directory-Effective-Permissions.png
1.bp.blogspot.com/-iSEzHNbAVHM/WXWM3-EPM4I/AAAAAAAACmA/XkMrGa7aE-ghxiFveM7z4JGLNBIk0hNMwCLcBGAs/w72-h72-p-k-no-nu/ 9 KB
9 KB 25ms
24ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1.bp.blogspot.com/-iSEzHNbAVHM/WXWM3-EPM4I/AAAAAAAACmA/XkMrGa7aE-ghxiFveM7z4JGLNBIk0hNMwCLcBGAs/w72-h72-p-k-no-nu/Active-Directory-Effective-Permissions.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

5ab136892d17a2373cbd31203c49432bd0315a4ada232d36cd04f71aa05ffb46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-iSEzHNbAVHM/WXWM3-EPM4I/AAAAAAAACmA/XkMrGa7aE-ghxiFveM7z4JGLNBIk0hNMwCLcBGAs/w72-h72-p-k-no-nu/Active-Directory-Effective-Permissions.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 1.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:54 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="Active-Directory-Effective-Permissions.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 8904
x-xss-protection: 1; mode=block
server: fife
etag: "va6c"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:54 GMT

GET
H2 200 An-ACE-Up-The-Sleeve.png
3.bp.blogspot.com/-JrSV8kYOTIo/Wezkxzg-AYI/AAAAAAAADCk/1mqlfCnc3mkx2KaJfurYENlVwmnpaXGewCLcBGAs/w72-h72-p-k-no-nu/ 2 KB
2 KB 16ms
16ms Image
image/png 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.bp.blogspot.com/-JrSV8kYOTIo/Wezkxzg-AYI/AAAAAAAADCk/1mqlfCnc3mkx2KaJfurYENlVwmnpaXGewCLcBGAs/w72-h72-p-k-no-nu/An-ACE-Up-The-Sleeve.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

066e58c1c8eac10755f8804f35a9428272a21b744aafd0f5664247fc9a44e288

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /-JrSV8kYOTIo/Wezkxzg-AYI/AAAAAAAADCk/1mqlfCnc3mkx2KaJfurYENlVwmnpaXGewCLcBGAs/w72-h72-p-k-no-nu/An-ACE-Up-The-Sleeve.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 3.bp.blogspot.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:55 GMT
x-content-type-options: nosniff
status: 200
content-disposition: inline;filename="An-ACE-Up-The-Sleeve.png"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1897
x-xss-protection: 1; mode=block
server: fife
etag: "vc2a"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H/1.1 200
OK The_Paramount_Brief.jpg
1.bp.blogspot.com/-f1UpkJb58ys/URw0glNUR0I/AAAAAAAAAuQ/WvkmPcd1OqY/s250/ 7 KB
7 KB 22ms
16ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://1.bp.blogspot.com/-f1UpkJb58ys/URw0glNUR0I/AAAAAAAAAuQ/WvkmPcd1OqY/s250/The_Paramount_Brief.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

a0bb2f6780e4f9011328688eac5fca15dc2079a2fc0d0293f880dc2ecbd6f27e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
X-Content-Type-Options: nosniff
Server: fife
ETag: "v2e4"
Vary: Origin
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="The_Paramount_Brief.jpg"
Timing-Allow-Origin: *
Content-Length: 6983
X-XSS-Protection: 1; mode=block
Expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H/1.1 200
OK LicenseTo.jpg
1.bp.blogspot.com/-jrxWE33UQ-s/URw-0NQKZCI/AAAAAAAAAuo/h9YaeI0jRAw/s250/ 8 KB
8 KB 24ms
19ms Image
image/jpeg 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://1.bp.blogspot.com/-jrxWE33UQ-s/URw-0NQKZCI/AAAAAAAAAuo/h9YaeI0jRAw/s250/LicenseTo.jpg

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

fed1cd7bb27f03d62073e9b1ec59d3a9395a0ad9f79be954c19558bb6b8ce0f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
X-Content-Type-Options: nosniff
Server: fife
ETag: "v2ea"
Vary: Origin
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="LicenseTo.jpg"
Timing-Allow-Origin: *
Content-Length: 7986
X-XSS-Protection: 1; mode=block
Expires: Sun, 26 Nov 2017 23:46:55 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 43 KB
17 KB 55ms
33ms Script
application/javascript 2a00:1450:4001:81c::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

2527af83e26405670c377a182e363a83b1f03771b439e64ee0a29d8ee7a75ba4

Security Headers

Name	Value
Content-Security-Policy	script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20171120.14_p0
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /js/plusone.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

content-security-policy: script-src 'unsafe-inline' 'unsafe-eval' 'self' https://*.gstatic.com https://www.google-analytics.com https://pagead2.googleadservices.com https://pagead2.googlesyndication.com https://tpc.googlesyndication.com https://s.ytimg.com https://www.youtube.com;report-uri /_/cspreport/es_oz_20171120.14_p0
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
date: Sat, 25 Nov 2017 23:46:55 GMT
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "d4be1acf57e527bc7e59ae84251aa7c4"
set-cookie: NID=118=Li_Me42Ywx1BaGPNJt4SXoOYXaAT9in5rrnubgDOqReT_y4SNEDeC1k1I6MO9m2rYjtkej5cof0E_mHciR8kHwmUsoMLyWRYR5-Rd33XGiWT1bn-B6AVhHWGt9IPpCbt;Domain=.google.com;Path=/;Expires=Sun, 27-May-2018 23:46:55 GMT;HttpOnly
timing-allow-origin: *
expires: Sat, 25 Nov 2017 23:46:55 GMT

GET
H/1.1 200
OK cookiechoices.js Show response
www.active-directory-security.com/js/ 6 KB
2 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:81c::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.active-directory-security.com/js/cookiechoices.js

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2013 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9496f34272ab65a565d50b909f2396ce799c30ef05f2ddd54fae11ed19fe6fa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.active-directory-security.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Mar 2017 02:50:03 GMT
Server: sffe
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: public, max-age=604800
Accept-Ranges: bytes
Content-Length: 1949
X-XSS-Protection: 1; mode=block
Expires: Sat, 02 Dec 2017 23:46:55 GMT

GET
H2 200 share_buttons_20_3.png
www.blogger.com/img/ 5 KB
5 KB 6ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.blogger.com/img/share_buttons_20_3.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

3829a5b2ade7cfc416c80b8f3df71e49e68672875f025d525223978f5cee3fd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/share_buttons_20_3.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.blogger.com
referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
:scheme: https
:method: GET
Referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:42:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 22 Nov 2017 09:33:59 GMT
server: sffe
age: 291868
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 5080
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:42:26 GMT

GET
H2 200 3577707566-widgets.js Show response
www.blogger.com/static/v1/widgets/ 126 KB
45 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

03b4dd14a1bb34ff5f93c7468408a75de96fa029ea4fe2325b03803d9cbad190

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/widgets/3577707566-widgets.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 23 Nov 2017 01:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 23 Nov 2017 00:04:15 GMT
server: sffe
age: 252786
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 45872
x-xss-protection: 1; mode=block
expires: Fri, 23 Nov 2018 01:33:48 GMT

GET
H2 200 s_top.png
resources.blogblog.com/img/widgets/ 335 B
344 B 7ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/widgets/s_top.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

cfe1d5dd45c7f0897d769e6c95ae9036fbdc7dad76ac9ed6ce6b21a785ecd6de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/widgets/s_top.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: resources.blogblog.com
referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
:scheme: https
:method: GET
Referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:13:33 GMT
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 18:34:35 GMT
server: sffe
age: 293601
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 335
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:13:33 GMT

GET
H2 200 s_bottom.png
resources.blogblog.com/img/widgets/ 172 B
181 B 6ms
6ms Image
image/png 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://resources.blogblog.com/img/widgets/s_bottom.png

Requested by

Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

91fe35689444e53c1bf3e04f24c154fa0468be9edd3c84344f9f64c2eff89eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /img/widgets/s_bottom.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: resources.blogblog.com
referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
:scheme: https
:method: GET
Referer: https://www.blogger.com/static/v1/widgets/3213516723-css_bundle_v2.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 14:24:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 19:46:25 GMT
server: sffe
age: 292973
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 172
x-xss-protection: 1; mode=block
expires: Wed, 29 Nov 2017 14:24:01 GMT

GET

comment-iframe.g
www.blogger.com/ Frame 1664
Redirect Chain

https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047
https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/comment-iframe.g?blogID%3D5958499117721089763%26postID%3D9170327295752271703%26blogspotRpcToken%3D947047%26bpli%3D1&followu...
https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047&bpli=1

0
0

GET
H/1.1 200
OK counter.js Show response
www.statcounter.com/counter/ 28 KB
10 KB 252ms
6ms Script
application/x-javascript 148.253.246.70
CDNetworks Inc.

General

Check archive.org

Show headers Download Go to

Full URL: http://www.statcounter.com/counter/counter.js
Requested by: Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Protocol: HTTP/1.1
Server: 148.253.246.70 , United States, ASN36408 (CDNETWORKSUS-02 - CDNetworks Inc., US),
Reverse DNS
Software: PWS/8.3.0.10 /
Resource Hash: 03da92f035c699a414e7379fc4e431b20d29e4901ed6b1172eb30f2d7308c2ca

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.statcounter.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Accept: */*
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 Apr 2017 13:36:00 GMT
Server: PWS/8.3.0.10
Age: 20707
ETag: W/"59034540-7083"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43200
X-Px: ht h0-s4014.p11-fra.cdngp.net
Connection: keep-alive
Content-Length: 10411
Expires: Sun, 26 Nov 2017 06:01:48 GMT

GET
H/1.1 200
OK Cookie set t.php
c.statcounter.com/ 49 B
49 B 324ms
318ms Image
image/gif 104.20.3.47
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://c.statcounter.com/t.php?sc_project=8707683&java=1&security=97c578cb&u1=EE13EDD87DA04F294FE955316A259602&sc_random=0.2405615028100112&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=http%3A//www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html&t=The%20Active%20Directory%20Security%20Blog%3A%20How%20to%20Prevent%20a%20Perpetrator%20from%20Using%20Mimikatz%20DCSync%20feature%20to%20perform%20Credential%20Theft%20from%20Active%20Directory&rcat=d&rdom=d&sc_snum=1&sess=7a9eb4&p=0&invisible=1
Requested by: Host: www.active-directory-security.com
URL: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Protocol: HTTP/1.1
Server: 104.20.3.47 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare-nginx /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: c.statcounter.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
Content-Type: image/gif
Server: cloudflare-nginx
P3P: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Set-Cookie: __cfduid=d1245d5d0de3ce85792f61ceed33e3f451511653615; expires=Sun, 25-Nov-18 23:46:55 GMT; path=/; domain=.statcounter.com; HttpOnly is_unique=sc8707683.1511653615.0; expires=Thu, 24-Nov-2022 23:46:55 GMT; path=/; domain=.statcounter.com
Connection: keep-alive
CF-RAY: 3c387d76d79c974a-FRA
Content-Length: 49
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/ 130 KB
46 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81c::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

c836f530e8899c42d7803a7bcea13344721740d6cb77397813f8ac6e8b48c979

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/cb=gapi.loaded_0
pragma: no-cache
cookie: NID=118=Li_Me42Ywx1BaGPNJt4SXoOYXaAT9in5rrnubgDOqReT_y4SNEDeC1k1I6MO9m2rYjtkej5cof0E_mHciR8kHwmUsoMLyWRYR5-Rd33XGiWT1bn-B6AVhHWGt9IPpCbt
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 00:21:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 03:19:19 GMT
server: sffe
age: 343501
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 46638
x-xss-protection: 1; mode=block
expires: Thu, 22 Nov 2018 00:21:54 GMT

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/ 70 KB
25 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:81c::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

77891466e11578971845acbfed790a533d7988c3c207fed7f5d0095c1fa6e5a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /_/scs/apps-static/_/js/k=oz.gapi.de.AH3ReJsExgM.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw/cb=gapi.loaded_1
pragma: no-cache
cookie: NID=118=Li_Me42Ywx1BaGPNJt4SXoOYXaAT9in5rrnubgDOqReT_y4SNEDeC1k1I6MO9m2rYjtkej5cof0E_mHciR8kHwmUsoMLyWRYR5-Rd33XGiWT1bn-B6AVhHWGt9IPpCbt
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: apis.google.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Wed, 22 Nov 2017 00:08:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 21 Nov 2017 03:19:19 GMT
server: sffe
age: 344318
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 25742
x-xss-protection: 1; mode=block
expires: Thu, 22 Nov 2018 00:08:17 GMT

GET fastbutton
apis.google.com/se/0/_/+1/ Frame 1664 0
0

GET
H/1.1 200
OK active-directory-credential-theft-mimikatz-dcsync-mitigation.html Show response
www.active-directory-security.com/2016/08/ 494 B
301 B 158ms
158ms XHR
text/javascript 2a00:1450:4001:81c::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html?action=backlinks&widgetId=Blog1&widgetType=Blog&responseType=js&postID=9170327295752271703&xssi_token=AOuZoY7QDzmOodWh1HzF6Bb5umnanJbtIw%3A1511653614320

Requested by

Host: www.blogger.com
URL: https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:81c::2013 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GSE /

Resource Hash

2fbf428aedf80bcc2179df32c51ec0a623a9d04e7b342367c5e203580f68957b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.active-directory-security.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
Cookie: sc_is_visitor_unique=rx8707683.1511653615.EE13EDD87DA04F294FE955316A259602.1.1.1.1.1.1.1.1.1
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Sat, 25 Nov 2017 23:46:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Nov 2017 22:46:32 GMT
Server: GSE
ETag: "f1838253-98c7-439e-95bc-4cb9d0aedf46"
Content-Type: text/javascript; charset=UTF-8
Cache-Control: private, max-age=0
Content-Length: 301
X-XSS-Protection: 1; mode=block
Expires: Sat, 25 Nov 2017 23:46:55 GMT

GET postmessageRelay
accounts.google.com/o/oauth2/ Frame 1664 0
0

GET
H2 200 368954415-lightbox_bundle.css
www.blogger.com/static/v1/v-css/ 35 KB
6 KB 6ms
6ms Stylesheet
text/css 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/v-css/368954415-lightbox_bundle.css

Requested by

Host: www.blogger.com
URL: https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

b60a462099b715aa3a5442a07142b969b9bb9c5ecee1bbdabea2e23f2d499458

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/v-css/368954415-lightbox_bundle.css
pragma: no-cache
cookie: S=blogger=D5CY8VICAJrgEgekosMMw0aLXm1XeOB0
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 09 Nov 2017 06:04:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Nov 2017 10:46:38 GMT
server: sffe
age: 1446119
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 6541
x-xss-protection: 1; mode=block
expires: Fri, 09 Nov 2018 06:04:57 GMT

GET
H2 200 DGVm0ieW2MiAs9L4cRaWG6hp_TsdsmqmZZz88cHVlXWGildppC47FAiSK5RKPWXajsRGvCIymrO5Rrw57gp8oAQL=s0-d
lh6.googleusercontent.com/proxy/ 1 KB
711 B 37ms
16ms Image
image/x-icon 2a00:1450:4001:81c::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh6.googleusercontent.com/proxy/DGVm0ieW2MiAs9L4cRaWG6hp_TsdsmqmZZz88cHVlXWGildppC47FAiSK5RKPWXajsRGvCIymrO5Rrw57gp8oAQL=s0-d

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:81c::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

aa01668bef50a1f40bc1b9ed150da250b1297a3c2bb0d4a734a6c68efb100a92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /proxy/DGVm0ieW2MiAs9L4cRaWG6hp_TsdsmqmZZz88cHVlXWGildppC47FAiSK5RKPWXajsRGvCIymrO5Rrw57gp8oAQL=s0-d
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: lh6.googleusercontent.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Sat, 25 Nov 2017 23:46:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-disposition: attachment;filename="unnamed"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 693
x-xss-protection: 1; mode=block
server: fife
vary: Origin
content-type: image/x-icon
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 26 Nov 2017 23:46:56 GMT

GET
H2 200 1219124111-lbx.js Show response
www.blogger.com/static/v1/jsbin/ 388 KB
126 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:81c::2009
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.blogger.com/static/v1/jsbin/1219124111-lbx.js

Requested by

Host: www.blogger.com
URL: https://www.blogger.com/static/v1/widgets/3577707566-widgets.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:81c::2009 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

a6e5d71479a8d0b0e5166690eb627f812c8fb92ce49b4b22f11a20828443ecbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /static/v1/jsbin/1219124111-lbx.js
pragma: no-cache
cookie: S=blogger=D5CY8VICAJrgEgekosMMw0aLXm1XeOB0
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.blogger.com
referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
:scheme: https
:method: GET
Referer: http://www.active-directory-security.com/2016/08/active-directory-credential-theft-mimikatz-dcsync-mitigation.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 23 Nov 2017 02:05:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 23 Nov 2017 00:59:09 GMT
server: sffe
age: 250869
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 128809
x-xss-protection: 1; mode=block
expires: Fri, 23 Nov 2018 02:05:47 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.blogger.com
URL: https://www.blogger.com/comment-iframe.g?blogID=5958499117721089763&postID=9170327295752271703&blogspotRpcToken=947047&bpli=1

Domain: apis.google.com
URL: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&source=blogger%3Ablog%3Aplusone&size=medium&width=300&annotation=inline&hl=en&origin=http%3A%2F%2Fwww.active-directory-security.com&url=http%3A%2F%2Fwww.active-directory-security.com%2F2016%2F08%2Factive-directory-credential-theft-mimikatz-dcsync-mitigation.html&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.AH3ReJsExgM.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw

Domain: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Fwww.active-directory-security.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.AH3ReJsExgM.O%2Fm%3D__features__%2Fam%3DAQ%2Frt%3Dj%2Fd%3D1%2Frs%3DAGLTcCMH2kjzwqD1o7rG0QjaeanEyvhbWw

Verdicts & Comments Add Verdict or Comment

166 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-18 16:17:44	Name: NID Value: 118=Li_Me42Ywx1BaGPNJt4SXoOYXaAT9in5rrnubgDOqReT_y4SNEDeC1k1I6MO9m2rYjtkej5cof0E_mHciR8kHwmUsoMLyWRYR5-Rd33XGiWT1bn-B6AVhHWGt9IPpCbt
.blogger.com/	1970-01-01 00:00:00	Name: S Value: blogger=D5CY8VICAJrgEgekosMMw0aLXm1XeOB0
accounts.google.com/	1970-01-19 05:25:25	Name: GAPS Value: 1:XUlKog59k15e2KLNN2oENnqKki-e6g:VccCrjPdPcJzx__j
.www.active-directory-security.com/	1970-01-19 05:25:25	Name: sc_is_visitor_unique Value: rx8707683.1511653615.EE13EDD87DA04F294FE955316A259602.1.1.1.1.1.1.1.1.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
2.bp.blogspot.com
3.bp.blogspot.com
4.bp.blogspot.com
accounts.google.com
apis.google.com
c.statcounter.com
img1.blogblog.com
img2.blogblog.com
lh6.googleusercontent.com
resources.blogblog.com
www.active-directory-security.com
www.blogblog.com
www.blogger.com
www.paramountdefenses.com
www.statcounter.com
accounts.google.com
apis.google.com
www.blogger.com
104.20.3.47
148.253.246.70
2a00:1450:4001:81c::2001
2a00:1450:4001:81c::2009
2a00:1450:4001:81c::200e
2a00:1450:4001:81c::2013
97.74.249.31
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
03b4dd14a1bb34ff5f93c7468408a75de96fa029ea4fe2325b03803d9cbad190
03da92f035c699a414e7379fc4e431b20d29e4901ed6b1172eb30f2d7308c2ca
066e58c1c8eac10755f8804f35a9428272a21b744aafd0f5664247fc9a44e288
0d06215aa81f24b6a8add8513a214e27243bd0107ce54f11217f15183189ba58
1258cbe1e2900ec3df11a83a6bb6008d7a833f783a6df80b0d5d45a052ac1466
1928823b789f045c0c54eaf50e3203b40daca9918226530651d4b262964b7932
1dc360481ba7d2fe26ea02b529a81438595b8ddd4999ddcd54e05bf443aa79e5
2527af83e26405670c377a182e363a83b1f03771b439e64ee0a29d8ee7a75ba4
25d8978f8abed212a301ac5e66d22150d02f0d30e683c0c66ac45129e742cbef
28ab89f0285c48d2faed701905c185c302f2b389584a52ceaa76a91ea64dc3a7
2d60410dcba5d2b798539797bff5c8f81c69305e1a6c78035f512ed535b75f7d
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2fbf428aedf80bcc2179df32c51ec0a623a9d04e7b342367c5e203580f68957b
3829a5b2ade7cfc416c80b8f3df71e49e68672875f025d525223978f5cee3fd3
39c61a14b0560db7fed76a5f11ba672d5c337648374f0ed5a37cf97f8a96f790
3cd341f37642f8a58b0fe14c2645913449c0ffe10be6ba0986275bfef29bc319
3e6950a8f9b9593e0eea3aaafff50991970cdff280d3118446fce0673334dcaf
46d60abc7ad000a1b4e0ce09cefabbc63e2d25f8e4e052855eb971e673e09781
4bedbdc4f556abcc2df916e9b60b1d489ec97f1bb1638c0e703b69cc8f403de9
51e21df2b04a48d231a3a734d8ea1a8be6f8c417fd666c1aa8839c9c0278ca0e
5216a57fe09f61f0d4cda3faf38c089c5119d4c9e4b37184af58f2db81a8b64c
540f4b7abbcbb4ac5591d0074a696a22c8c8ff679e491a96bc05545c0600d4ff
5574e422712ea196228bc980107312471c8236ab861d65f77e8536d8d60cfbc3
5ab136892d17a2373cbd31203c49432bd0315a4ada232d36cd04f71aa05ffb46
5e516df49b160c3efcb1ea09dd4c5f5b7c99a23a18a2a882acc379179bdbaacd
630e4fd46a40c9983b7e8dcdee9366f5f7a921e8dc6882281dfced08b5744858
6a1dfbb61a63a55cc6579c6dc42f3b42b54fd577b6eb44d728bf96d3611711a6
6b9b8ab0ce6401bf12dcfbe31f2fd2b24dce47bfb18c67cba6101c4323e3bdfa
6cff6c1642641adfa31e159d5f29b48fd96eebb4a75b873ea18e3bea7742aeff
6f58ab7ea31a499e1956c5cceeb0ee864e9b67bf4737d25f0b47961478b63f7d
71b8ad79c680b3e5d452a792c3b418b23f739a0a34005e0f37ec674f4c78cb5d
7249cd37017e0d4c8b034563a6e7f356af978956ae451679d8882a123bad88a4
77891466e11578971845acbfed790a533d7988c3c207fed7f5d0095c1fa6e5a4
7b317a98d6ed147189a2796700b5723991e017d8f370352f1afe00c8321e70f9
91fe35689444e53c1bf3e04f24c154fa0468be9edd3c84344f9f64c2eff89eeb
9496f34272ab65a565d50b909f2396ce799c30ef05f2ddd54fae11ed19fe6fa6
a0bb2f6780e4f9011328688eac5fca15dc2079a2fc0d0293f880dc2ecbd6f27e
a15dc2e70162366548e23c843a4e71d900eb70c1ebbab995bbe736377e309c6f
a6e5d71479a8d0b0e5166690eb627f812c8fb92ce49b4b22f11a20828443ecbc
aa01668bef50a1f40bc1b9ed150da250b1297a3c2bb0d4a734a6c68efb100a92
b60a462099b715aa3a5442a07142b969b9bb9c5ecee1bbdabea2e23f2d499458
b841b5283ae3e5ced1658ed7d61a45bed8ece32d667ec4b15f823088a7b11ee1
b9bf378dcddc62e35d7cccdb1ab76e96e8e47b67dedf269d175ae66b5ed501e0
bbf9b924cc32bff4738bb54d86905476349f90c8b20f748633e56f64379d553e
bfeab86d6f6f08ef1929dcd1df932d1103e35c4f6afa75becbaaf776007e3084
c4ece62f522d87c0b7989d999296fe6026b8e0dd1a40ade26090901982214648
c836f530e8899c42d7803a7bcea13344721740d6cb77397813f8ac6e8b48c979
c9dbbd812944f90742d69c10481ef9860b4dc061d8ca07a5fd16d3766f802cd3
ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b
cfe1d5dd45c7f0897d769e6c95ae9036fbdc7dad76ac9ed6ce6b21a785ecd6de
d172d750493be64a7ed84dec1dd2a0d787ba42f78bc694b0858f152c52b6620b
d83f6f8ac2b827bb36e6a5a81cd4209f25ad22d52df316db88025a57568c14fe
d911c89b6ebb23dc1e5b3374b1423722560d2d4bc0270b0e3c246d332658f820
dc951757d4534238bf3c44d30753b14af10dff3275cdd0c39156f8b0191c28cb
e8c887fbb469aa8d8e7e375a9685d9c5ef3768e0575d29ca384cb8817a6c4d4c
f70e6f049afbfe7161dfd6da14e30fcee1babdb3976fd0ec3d924b5d5846b0b4
faf4225a56eda333692afb59c102d23609feb191c1fdee20e0a1f56a0ad998be
fed1cd7bb27f03d62073e9b1ec59d3a9395a0ad9f79be954c19558bb6b8ce0f2

www.active-directory-security.com Open in urlscan Pro 2a00:1450:4001:81c::2013 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

63 Requests

75 %HTTPS

57 %IPv6

8 Domains

16 Subdomains

8 IPs

2 Countries

1639 kBTransfer

2359 kBSize

4 Cookies

74 Outgoing links

Redirected requests

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.active-directory-security.com Open in urlscan Pro
2a00:1450:4001:81c::2013 Public Scan

Screenshot
Live screenshot

Full Image

63
Requests

75 %
HTTPS

57 %
IPv6

8
Domains

16
Subdomains

8
IPs

2
Countries

1639 kB
Transfer

2359 kB
Size

4
Cookies

63 HTTP transactions
0 data transactions