dfir.wrccdc.org Open in urlscan Pro
104.21.21.105 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://dfir.wrccdc.org/
Submission: On December 18 via api (December 18th 2023, 5:52:15 pm UTC) from US — Scanned from US

Summary HTTP 8 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 104.21.21.105, located in and belongs to CLOUDFLARENET, US. The main domain is dfir.wrccdc.org.
TLS certificate: Issued by E1 on December 9th 2023. Valid for: 3 months.

This is the only time dfir.wrccdc.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7	104.21.21.105 104.21.21.105	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	104.20.151.16 104.20.151.16	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.7.63 172.67.7.63	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2

7 104.21.21.105 (None, )

ASN13335 (CLOUDFLARENET, US)

dfir.wrccdc.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.151.16 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

i.creativecommons.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.7.63 (United States)

ASN13335 (CLOUDFLARENET, US)

licensebuttons.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	wrccdc.org dfir.wrccdc.org	72 KB
1	licensebuttons.net licensebuttons.net — Cisco Umbrella Rank: 25431	2 KB
1	creativecommons.org 1 redirects i.creativecommons.org — Cisco Umbrella Rank: 29229	231 B
8	3

	Domain	Requested by
7	dfir.wrccdc.org	dfir.wrccdc.org
1	licensebuttons.net	dfir.wrccdc.org
1	i.creativecommons.org	1 redirects
8	3

This site contains links to these domains. Also see Links.

Domain
www.nginx.com
github.com
goaccess.io
www.netresec.com
www.wireshark.org
www.packettotal.com
www.bro.org
creativecommons.org

Subject Issuer	Validity	Valid
wrccdc.org E1	`2023-12-09` - `2024-03-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dfir.wrccdc.org/
Frame ID: DB58E8BD56E7945917D0E79097BA03E1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

W R C C D C Public Archive

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

74 kB
Transfer

195 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.nginx.com/
Title: nginx

Search URL Search Domain Scan URL

URL: https://github.com/Naereen/Nginx-Fancyindex-Theme
Title: NGINX Fancy Index Theme

Search URL Search Domain Scan URL

URL: https://goaccess.io/
Title: goaccess

Search URL Search Domain Scan URL

URL: http://www.netresec.com/?page=NetworkMiner
Title: Network Miner

Search URL Search Domain Scan URL

URL: https://www.wireshark.org/
Title: Wireshark

Search URL Search Domain Scan URL

URL: https://www.packettotal.com/
Title: PacketTotal

Search URL Search Domain Scan URL

URL: https://www.bro.org/
Title: Bro

Search URL Search Domain Scan URL

URL: http://creativecommons.org/licenses/by-sa/4.0/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://i.creativecommons.org/l/by-sa/4.0/88x31.png HTTP 301
https://licensebuttons.net/l/by-sa/4.0/88x31.png

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
dfir.wrccdc.org/ 4 KB
1 KB 430ms
308ms Document
text/html 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8508861f82e265fc7d986b613bebd6e181e1ad46e07ed2b0d668fd75c3eb3500

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8379420c6caada77-MIA
content-encoding: br
content-type: text/html
date: Mon, 18 Dec 2023 17:52:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ew%2B9cg63msszBmau8%2FXe7v7ktiitKeOacpnjy8DAbud8DYMrpYm%2BXqcgEUtPE7%2FUlHZLcgbr9bN7xfrWS0SZdz7jvTnORKcjZIefeiV5p7KRaRdaRSGDnp84MPRBvJ4CBgk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 styles.css
dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/ 4 KB
1 KB 335ms
333ms Stylesheet
text/css 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/styles.css
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b56a213e1c5847a3bc920af420bb0c490157d1680e2217432152974e05e89aba

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dfir.wrccdc.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 23 Apr 2018 04:18:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5add5e97-1141"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LAfWkoef8SmD1BtwN4tET8UI8upAoiG2vR%2Bsylwzb1DlC1L66W8c4GSiydu3ZgeKjFOnr5sjgNq0QROtdlYWtk%2BfLB16RnxogcdMopDQ5hpommbb%2FHqSUJrv6sM7KoP8hY4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 8379420e5878da77-MIA
alt-svc: h3=":443"; ma=86400
expires: Wed, 17 Jan 2024 18:26:37 GMT

GET
H2 200 jquery.min.js Show response
dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/ 82 KB
30 KB 476ms
475ms Script
application/javascript 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/jquery.min.js
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7369c6697458597456e17036022297f1f04d4735b3229b967fd0faf6e46bc1a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dfir.wrccdc.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 23 Apr 2018 04:18:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5add5e97-146d3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3IQ%2BMVJygmjYC00u6btOtghMe6PcKh32inIFILJHIfK%2FJyG0Fjf9LIt4YCMCSD2hm3a0jHP2Nyb11TO1JwBI9WsJPTbmNY8tSIkbeBWN%2Fdajbihlpa9rvO2toawvnU5Y5oI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8379420e587ada77-MIA
alt-svc: h3=":443"; ma=86400
expires: Wed, 17 Jan 2024 18:26:37 GMT

GET
H2

200

88x31.png
licensebuttons.net/l/by-sa/4.0/
Redirect Chain

https://i.creativecommons.org/l/by-sa/4.0/88x31.png
https://licensebuttons.net/l/by-sa/4.0/88x31.png

1 KB
2 KB

662ms
50ms

Image
image/png

172.67.7.63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://licensebuttons.net/l/by-sa/4.0/88x31.png

Requested by

Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/

Protocol

Server

172.67.7.63 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c08e14ab3d42e97ef3a9134a75af83c2fbbc33acca238e4f9371ae58c696aee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dfir.wrccdc.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:10 GMT
strict-transport-security: max-age=15768000
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5467
cf-polished: origSize=5083
content-length: 1515
x-xss-protection: 1; mode=block
cf-bgj: imgq:100,h2pri
last-modified: Thu, 30 Apr 2020 21:59:13 GMT
server: cloudflare
etag: "5eab4a31-13db"
x-frame-options: deny
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=432000
accept-ranges: bytes
cf-ray: 837942130e60749c-MIA

Redirect headers

date: Mon, 18 Dec 2023 17:52:10 GMT
strict-transport-security: max-age=15768000
x-content-type-options: nosniff
cf-cache-status: HIT
server: cloudflare
age: 902
x-frame-options: deny
vary: Accept-Encoding
content-type: text/html
location: https://licensebuttons.net/l/by-sa/4.0/88x31.png
cf-ray: 8379420eecea8dc1-MIA
x-xss-protection: 1; mode=block

GET
H2 200 addNginxFancyIndexForm.js Show response
dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/ 1 KB
975 B 304ms
303ms Script
application/javascript 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/addNginxFancyIndexForm.js
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f30dca7c2a64bcefcc1c169f4c8ffdb81d8319102da2f910afbbb9cbc281f10f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dfir.wrccdc.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 23 Apr 2018 04:18:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5add5e97-440"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J6eFLidGW4EzVRZaSrX%2FMMXmE%2BANpVGGYUMdeHs9PW1aaYto1DxvWAyBZwkCUYhk3vAmAne9fpp%2BG%2FC9QlZUvd6wMjme8hEXhG1T6TvuIJqX2o%2FJcyzegZNBwNva5zLABDg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8379420e587dda77-MIA
alt-svc: h3=":443"; ma=86400
expires: Wed, 17 Jan 2024 18:26:37 GMT

GET
H3 200 showdown.min.js Show response
dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/ 97 KB
32 KB 438ms
437ms Script
application/javascript 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/showdown.min.js
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 770869a48af10fca82ea536e96775982d226e17054f73a0c77d394a17cc80c01

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dfir.wrccdc.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:10 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 28 Feb 2018 04:44:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"5a9633bc-18317"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YKdzIUH4VKfNFSoRFbIhbsK8a%2BoNv3z3CeZ9OA9TAf2EB%2FK1aenDhe9wwUQySzg0HfQLIRhO1icanjRzu6%2BYkt0nQBJm9u3r%2BaHHVnnME17Yc8Av8t7Fxe2Q8unq2Bg3wBA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 83794210498d67bc-MIA
alt-svc: h3=":443"; ma=86400
expires: Wed, 17 Jan 2024 18:26:37 GMT

GET
H3 404 HEADER.md Show response
dfir.wrccdc.org/ 548 B
524 B 302ms
302ms XHR
text/html 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/HEADER.md
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

Accept: text/html, */*; q=0.01
Referer: https://dfir.wrccdc.org/
X-Requested-With: XMLHttpRequest
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:11 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PVJxOcq7mV6hzRlm1Tu6hfBgehRyRfvd4CJm2nYtWzJVkhoD5eYzce6hAUAMt0zqe8CSclIKfg7n0gIWiPkGZmgI7k1iUpzhpmU%2FPBZ8thQIUHZcMpSSI8tPs4AZibqugLw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cf-ray: 837942134ef167bc-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 README.md Show response
dfir.wrccdc.org/ 5 KB
6 KB 303ms
303ms XHR
application/octet-stream 104.21.21.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dfir.wrccdc.org/README.md
Requested by: Host: dfir.wrccdc.org
URL: https://dfir.wrccdc.org/Nginx-Fancyindex-Theme-light/jquery.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.21.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 951b756299f7a14588691a3745eeea9ad0f6569f1905a87b080049d3e7c9b0b9

Request headers

Accept: text/html, */*; q=0.01
Referer: https://dfir.wrccdc.org/
X-Requested-With: XMLHttpRequest
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 18 Dec 2023 17:52:11 GMT
cf-cache-status: DYNAMIC
last-modified: Sat, 19 Feb 2022 06:08:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6210894d-15e0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8K84i4Oouou6bf%2F8mTX8TwYjWMKWUCzPlxRquvHHa5bwlvSEOO5K2917S2b1QR6nGzqWzRvMc68JWkW%2FDujZ7Zz8Tdr8z5Xop%2F9rxUxWf137wZ%2Fd%2F2nPUmtTMqGQdNxocUo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
accept-ranges: bytes
cf-ray: 837942134ef267bc-MIA
alt-svc: h3=":443"; ma=86400
content-length: 5600

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://dfir.wrccdc.org/HEADER.md Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dfir.wrccdc.org
i.creativecommons.org
licensebuttons.net
104.20.151.16
104.21.21.105
172.67.7.63
770869a48af10fca82ea536e96775982d226e17054f73a0c77d394a17cc80c01
8508861f82e265fc7d986b613bebd6e181e1ad46e07ed2b0d668fd75c3eb3500
951b756299f7a14588691a3745eeea9ad0f6569f1905a87b080049d3e7c9b0b9
b56a213e1c5847a3bc920af420bb0c490157d1680e2217432152974e05e89aba
b7369c6697458597456e17036022297f1f04d4735b3229b967fd0faf6e46bc1a
c08e14ab3d42e97ef3a9134a75af83c2fbbc33acca238e4f9371ae58c696aee0
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
f30dca7c2a64bcefcc1c169f4c8ffdb81d8319102da2f910afbbb9cbc281f10f

dfir.wrccdc.org Open in urlscan Pro 104.21.21.105 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

74 kBTransfer

195 kBSize

0 Cookies

8 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

dfir.wrccdc.org Open in urlscan Pro
104.21.21.105 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

74 kB
Transfer

195 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions