dfir.ru
Open in
urlscan Pro
192.0.78.24
Public Scan
Effective URL: https://dfir.ru/
Submission Tags: falconsandbox
Submission: On October 08 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 12th 2022. Valid for: 3 months.
This is the only time dfir.ru was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 192.0.78.24 192.0.78.24 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
14 | 192.0.77.32 192.0.77.32 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a04:fa87:fff... 2a04:fa87:fffe::c000:4902 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 192.0.72.18 192.0.72.18 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
4 | 192.0.76.3 192.0.76.3 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 192.0.78.19 192.0.78.19 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
26 | 8 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
wp.com
s0.wp.com — Cisco Umbrella Rank: 7897 stats.wp.com — Cisco Umbrella Rank: 3434 pixel.wp.com — Cisco Umbrella Rank: 2931 |
139 KB |
3 |
gravatar.com
0.gravatar.com — Cisco Umbrella Rank: 9479 |
10 KB |
2 |
wordpress.com
dfirru.files.wordpress.com r-login.wordpress.com — Cisco Umbrella Rank: 33104 |
2 KB |
2 |
dfir.ru
1 redirects
dfir.ru |
23 KB |
1 |
gstatic.com
fonts.gstatic.com |
33 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 118 |
1 KB |
26 | 6 |
Domain | Requested by | |
---|---|---|
14 | s0.wp.com |
dfir.ru
|
3 | pixel.wp.com |
dfir.ru
|
3 | 0.gravatar.com |
dfir.ru
0.gravatar.com |
2 | dfir.ru | 1 redirects |
1 | r-login.wordpress.com |
dfir.ru
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | stats.wp.com |
dfir.ru
|
1 | dfirru.files.wordpress.com |
dfir.ru
|
1 | fonts.googleapis.com |
dfir.ru
|
26 | 9 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
tls.automattic.com R3 |
2022-08-12 - 2022-11-10 |
3 months | crt.sh |
*.wp.com Sectigo RSA Domain Validation Secure Server CA |
2022-06-11 - 2023-07-12 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA |
2020-08-14 - 2022-11-16 |
2 years | crt.sh |
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA |
2021-12-28 - 2023-01-28 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA |
2020-08-12 - 2022-11-14 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://dfir.ru/
Frame ID: 093E65150F72F31AD43E9978AED22FA9
Requests: 25 HTTP requests in this frame
Frame:
https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9kZmlyLnJ1&wpcomid=149118243&time=1665217244
Frame ID: C68C72A6B5BC16B9F87835344D3149DC
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
My DFIR Blog – Digital Forensics & Incident Response & Reverse EngineeringPage URL History Show full URLs
-
http://dfir.ru/
HTTP 301
https://dfir.ru/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- <link[^>]+s\d+\.wp\.com
- /wp-(?:content|includes)/
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
Title: the file system specification
Search URL Search Domain Scan URL
Title: DOC
Search URL Search Domain Scan URL
Title: PDF
Search URL Search Domain Scan URL
Title: article on Wikipedia
Search URL Search Domain Scan URL
Title: warned
Search URL Search Domain Scan URL
Title: Windows registry file format specification
Search URL Search Domain Scan URL
Title: Measured Boot and Malware Signatures: exploring two vulnerabilities found in the Windows loader
Search URL Search Domain Scan URL
Title: here
Search URL Search Domain Scan URL
Title: here
Search URL Search Domain Scan URL
Title: Arsenal Image Mounter
Search URL Search Domain Scan URL
Title: my Windows registry file format specification
Search URL Search Domain Scan URL
Title: Create a website or blog at WordPress.com
Search URL Search Domain Scan URL
Title: Log in now.
Search URL Search Domain Scan URL
Title: Customize
Search URL Search Domain Scan URL
Title: Sign up
Search URL Search Domain Scan URL
Title: Report this content
Search URL Search Domain Scan URL
Title: View site in Reader
Search URL Search Domain Scan URL
Title: Manage subscriptions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://dfir.ru/
HTTP 301
https://dfir.ru/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dfir.ru/ Redirect Chain
|
85 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
257 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global.css
s0.wp.com/wp-content/themes/h4/ |
323 B 227 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
117 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wp-emoji-release.min.js
s0.wp.com/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global-print.css
s0.wp.com/wp-content/mu-plugins/global-print/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gprofiles.js
0.gravatar.com/js/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wpgroho.js
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ |
868 B 429 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
41 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cropped-logo1.png
dfirru.files.wordpress.com/2018/07/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
33 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s0.wp.com/_static/ |
92 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w.js
stats.wp.com/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v24/ |
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 75 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
g.gif
pixel.wp.com/ |
50 B 75 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hovercard.min.css
0.gravatar.com/dist/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
services.min.css
0.gravatar.com/dist/css/ |
3 KB 582 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
remote-login.php
r-login.wordpress.com/ Frame C68C |
117 B 290 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
actionbar.js
s0.wp.com/wp-content/mu-plugins/actionbar/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
67 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| wpcom_remote_login_extra_auth function| wpcom_remote_login_remove_dom_node_id function| wpcom_remote_login_remove_dom_node_classes function| wpcom_remote_login_final_cleanup function| addLoadEvent object| _wpemojiSettings object| twemoji object| wp object| actionbardata object| wpcom_mobile_user_agent_info function| rltInvalidateToken function| rltInjectToken function| rltIsAuthenticated function| rltGetToken function| rltAddInitializationListener function| rltStoreToken function| rltInitialize undefined| $ function| jQuery object| infiniteScroll object| _tkq object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| WPGroHo object| HighlanderComments function| textarea_autosize object| coblocksLigthboxData object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| wpcom_img_zoomer object| detectZoom object| wpcom object| _stq string| mobileStatsQueryString string| new_css0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0.gravatar.com
dfir.ru
dfirru.files.wordpress.com
fonts.googleapis.com
fonts.gstatic.com
pixel.wp.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
192.0.72.18
192.0.76.3
192.0.77.32
192.0.78.19
192.0.78.24
2a00:1450:4001:80b::2003
2a00:1450:4001:82a::200a
2a04:fa87:fffe::c000:4902
02b4cd26004ada045cd1def4869b00ab228261f31a71399d9ab2024e2bf7139f
12b349f45f949188251600bc380b456ff831863713c50d08560d9460c9ba2d93
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d
1a72c573becfb1e8529cc987d0508245574afed28a710b3ca816d0f52028c66d
4542137c751f4fa3c953955e67e98f7a95672cde8e65da7e7cbd230f5e21bd91
47109b8930a0453870e5f0d19fa81b9c7e9d174c9c606bbf61f05ed4645af1c9
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
6927f01a13b3d278efcd7e1f9fae899d1b2da7e35c07a9efb4256b5cfb072c03
6e6a13b702dcbefd26b97c37188f6ebdf46d2c3b8f8b0755acf6a97d53467dc4
74d560e4e6095f6054f8bf5c4c80608bb4057b436d1b2f68bef70423f5782b37
7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf
7db48314731b612123ecf61b9b435f24f4a9dd045724b3df76f9c985fd192da1
822183b6912f8ef43349d897aa66f65f840a059a488c1dae834f2e1b4d847c1c
8e657c0ef1763965fb05ff2d31c111675fc2869e3b32b2cb09ba9a0dacc34c76
90b76fae643307fa7880dfd5d81d176ddf33d7b4459dda41704a73b688f2db66
963611a5916c6de2cd9580b3ec43a961b9171c5d0fe8a7177181a8335924a88b
9a3993918629dfd6a59c4563e9b4d464152b51d4113957ab8ebfbdcbcdc7f536
9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087
a2319890dc49ce8bf617ee6e07902ea551298c9f2ce32c4c74daf2db815cad01
a2da270bc79a1290e19d4eba107784f6587dfcf542e0a96f7efca31c1f1fb9df
baec25d9abe4f4f28b7a5ae4a8e2f47407a2cbea378fffc357f54cc0388e2df7
d688e78f7a6800b797d132f8542a01d2320bc34caedb56dae8b1b7aa6f315b2a
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1