urlscan.io logo urlscan.io
SecurityTrails logo

blog.xorhex.com Open in urlscan Pro
216.24.57.253  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.co/TV0bcC4XX5
Effective URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Submission: On November 12 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 3 countries across 13 domains to perform 56 HTTP transactions. The main IP is 216.24.57.253, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is blog.xorhex.com.
TLS certificate: Issued by Cloudflare Inc RSA CA-2 on July 29th 2021. Valid for: a year.
This is the only time blog.xorhex.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
7    216.24.57.253 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
PTR: 216-24-57-253.ip.win.net
blog.xorhex.com
6    2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)
kit.fontawesome.com
9    54.157.58.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-58-70.compute-1.amazonaws.com
api.xorhex.com
1    2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
12    2606:4700::6810:7caf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
4    2606:4700:3037::ac43:a12f (United States)

ASN13335 (CLOUDFLARENET, US)
ka-f.fontawesome.com
9    2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
6    2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
www.gstatic.com
2    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:828::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
static.doubleclick.net
1    2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
yt3.ggpht.com
1    2a00:1450:4001:813::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
i.ytimg.com
Domain Requested by
12 unpkg.com 6 redirects blog.xorhex.com
9 www.youtube.com blog.xorhex.com
www.youtube.com
9 api.xorhex.com blog.xorhex.com
code.jquery.com
7 blog.xorhex.com t.co
blog.xorhex.com
6 cdnjs.cloudflare.com blog.xorhex.com
4 fonts.gstatic.com www.youtube.com
fonts.googleapis.com
4 ka-f.fontawesome.com kit.fontawesome.com
blog.xorhex.com
2 www.gstatic.com www.youtube.com
www.gstatic.com
2 googleads.g.doubleclick.net 1 redirects www.youtube.com
1 i.ytimg.com www.youtube.com
1 yt3.ggpht.com www.youtube.com
1 www.google.com www.youtube.com
1 static.doubleclick.net www.youtube.com
1 code.jquery.com blog.xorhex.com
1 kit.fontawesome.com blog.xorhex.com
1 fonts.googleapis.com blog.xorhex.com
1 t.co
56 17
Subject Issuer Validity Valid
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2021-02-05 -
2022-02-04		 a year crt.sh
blog.xorhex.com
Cloudflare Inc RSA CA-2		 2021-07-29 -
2022-07-28		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.fontawesome.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-13 -
2021-12-14		 a year crt.sh
api.xorhex.com
R3		 2021-11-11 -
2022-02-09		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
*.google.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh
edgestatic.com
GTS CA 1C3		 2021-10-18 -
2022-01-10		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Frame ID: DA7D3223011651548BDF53905A876495
Requests: 39 HTTP requests in this frame

Frame: https://www.youtube.com/embed/Ua82pW6439M
Frame ID: FBF4F8F3C3733ADEF33FFFDCB56DA555
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mustang Panda PlugX - 45.251.240.55 Pivot - Custom Tools, Reverse Engineering, and Threat Research

Page URL History Show full URLs

  1. https://t.co/TV0bcC4XX5 Page URL
  2. https://blog.xorhex.com/blog/mustangpandaplugx-1/ Page URL

Page Statistics

56
Requests

88 %
HTTPS

81 %
IPv6

13
Domains

17
Subdomains

17
IPs

3
Countries

2310 kB
Transfer

5578 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/TV0bcC4XX5 Page URL
  2. https://blog.xorhex.com/blog/mustangpandaplugx-1/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18
  • https://unpkg.com/lunr/lunr.js HTTP 302
  • https://unpkg.com/lunr@2.3.9/lunr.js
Request Chain 28
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Request Chain 42
  • https://unpkg.com/vis-data@7.1.2/peer/umd/vis-data.min.js?_=1636746547710 HTTP 302
  • https://unpkg.com/vis-data@7.1.2/peer/umd/vis-data.min.js
Request Chain 43
  • https://unpkg.com/vis-network@9.0.4/peer/umd/vis-network.min.js?_=1636746547711 HTTP 302
  • https://unpkg.com/vis-network@9.0.4/peer/umd/vis-network.min.js
Request Chain 44
  • https://unpkg.com/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js?_=1636746547712 HTTP 302
  • https://unpkg.com/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js
Request Chain 48
  • https://unpkg.com/vis-timeline/styles/vis-timeline-graph2d.min.css HTTP 302
  • https://unpkg.com/vis-timeline@7.5.0/styles/vis-timeline-graph2d.min.css
Request Chain 49
  • https://unpkg.com/vis-network/styles/vis-network.min.css HTTP 302
  • https://unpkg.com/vis-network@9.1.0/styles/vis-network.min.css

56 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
TV0bcC4XX5
t.co/ 		304 B
633 B 		Document
General
Check archive.org
Download Go to
Full URL
https://t.co/TV0bcC4XX5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
db29d76914ae9846348da5bcb40738b5e17991be4877ec3c591fa4f64984cd17
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Fri, 12 Nov 2021 19:49:05 GMT
vary
Origin
server
tsa_o
expires
Fri, 12 Nov 2021 19:54:06 GMT
content-type
text/html; charset=utf-8
cache-control
private,max-age=300
content-length
196
content-encoding
gzip
x-xss-protection
0
strict-transport-security
max-age=0
x-response-time
122
x-connection-hash
3b4bd0b43443210fa64de6ade9ca7fe32e6779a00dfd83f30ad56e0ddbe6592f
Primary Request /
blog.xorhex.com/blog/mustangpandaplugx-1/ 		23 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/blog/mustangpandaplugx-1/
Requested by
Host: t.co
URL: https://t.co/TV0bcC4XX5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
bf2ddcc3febf272ba7b6af7b2848f35e0cddbcd47d2eb50ad9382cf799853b31
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://t.co/

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-type
text/html; charset=utf-8
content-length
5914
cache-control
public, max-age=0, s-maxage=300
content-encoding
gzip
etag
"5392c7bcd79eb443355a94c1312e13db"
last-modified
Mon, 11 Oct 2021 03:49:00 UTC
x-content-type-options
nosniff
accept-ranges
bytes
via
1.1 varnish
age
0
x-served-by
cache-fra19127-FRA
x-cache
MISS
x-cache-hits
0
x-timer
S1636746547.777628,VS0,VE314
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6ad2481beaf14ed9-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/ 		763 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
17588736
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
271
cf-request-id
099eec99e6000005b307332000000001
timing-allow-origin
*
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-2fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6iJ%2BYUNJbvHc1MNdPtJ5xGgehVXWmFgjDFOFlWlPze7Peoandrv7E5bh3B1hXWoYYkBDKVF%2Bi2KX3xuNXMlq7UwR9i7mDOUy%2B0o%2F39F3wE1C%2F%2FbvKq6XYZ7iWh52to527RXoCeL0DabA46L4RzwCtfnG"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad2481fac3d2c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/ 		2 KB
972 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97ce4e98f3a3be297f48ebd5b771e74928f31754d43324fd795d1cd81cc41b35
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
348489
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
633
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:13:31 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03f2b-745"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D2AmVyzDyRuo3gjBC%2BasrlnSAscfnvdE1m0wkK%2F4SKBIUBlWR9uLqHLidUY0ccpzrq3NUgNSN5A5YzJPhyiyw5JfffW1TgsARdkv7RK9q4sfDM0KrdLccf8tRqNPrNi%2BPTCDzHuaCnuKr6Iwi7vDQCW5"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad2481fac442c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Raleway:400,800,900|Source+Sans+Pro:400,700
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
711bc66720153ec412b68f6fd2f1538ad17af33ba88d6bdfc89ca15f75b72b57
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
clear
x-xss-protection
0
last-modified
Fri, 12 Nov 2021 19:49:07 GMT
server
ESF
date
Fri, 12 Nov 2021 19:49:07 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 12 Nov 2021 19:49:07 GMT
academicons.min.css
cdnjs.cloudflare.com/ajax/libs/academicons/1.8.6/css/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/academicons/1.8.6/css/academicons.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8556030a7e2b2d9c901fa025108a0225f897d468fe3b1ab44a8dfe824cf566c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1461760
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
938
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:04:04 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03cf4-1238"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wPqu2g3SIAWPDt3XFXGz0%2Fz%2BBxVNQDcA53DGrzLnFPJn8KqySO6sBRA0GSP5hskJhKTKxhW85DP%2F9mz7aEdS27zQUGlMhnI3kWfPBRkJ70ndvnSZfnmDOePZgdKpC1hK6ldOXVx%2FX0qP6v0j%2FiPf5pAA"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad2481fac462c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
be54eb011a.js
kit.fontawesome.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kit.fontawesome.com/be54eb011a.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26aa83c9572c86364137527e26ad481e50be010007677cb07aada5bfd7bf6224
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload

Request headers

Referer
https://blog.xorhex.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
cf-cache-status
MISS
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
access-control-max-age
3000
cache-control
max-age=60, public, must-revalidate
strict-transport-security
max-age=31536000; preload
cf-ray
6ad2481fb8914ea4-FRA
access-control-allow-headers
accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id
FrbkUBROjSsrDreAKSYi
jquery.fancybox.min.css
cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
771329
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
2695
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e58-31fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RCwF8LnEG5f%2Fb9ioknypgFcLHCJJQ3DWLSRL6%2FuLVV%2BQn2bIsyF0APzcvb7QkrHOYsylHuCbajgPUNHS2Qh7td6uOtz3sxdEkMEDbn3cCN6L8CvvKdn3k5LOs6OYEoghIy1b6mOoPUNDL4HSbDnFhvGT"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad2481fac472c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
main.min.db5f7c24b564197df6497d519025664c4ebe7e6cb278e17de62b2edae43af3b4.css
blog.xorhex.com/css/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/css/main.min.db5f7c24b564197df6497d519025664c4ebe7e6cb278e17de62b2edae43af3b4.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
df168d10c9783cebfdae3e74ccb35a1df960ebba76c69c2a119c202d7093d8a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5928
x-served-by
cache-fra19180-FRA
last-modified
Mon, 11 Oct 2021 03:49:00 UTC
server
cloudflare
x-timer
S1636746547.151524,VS0,VE288
etag
"5358e52ae3b9bb0415a0b7b06926db86"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 varnish
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad2481f8a214ed9-FRA
x-cache-hits
0
add-on.css
blog.xorhex.com/css/ 		2 KB
873 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/css/add-on.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
87d5df681512e800b9923f70fa8eac1f6be2b21d101d459e3f8a8306b613975f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
734
x-served-by
cache-fra19127-FRA
last-modified
Mon, 11 Oct 2021 03:49:00 UTC
server
cloudflare
x-timer
S1636746547.153007,VS0,VE248
etag
"d8cc15c11ac443176b427719497f5bf5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 varnish
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad2481f8a244ed9-FRA
x-cache-hits
0
logo.jpg
blog.xorhex.com/img/main/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blog.xorhex.com/img/main/logo.jpg
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
93b13c4173ac5a78968ca16acfba3f16667ad6d350d4fddc854c2a21e18ff0fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 varnish
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
33478
x-served-by
cache-fra19170-FRA
last-modified
Mon, 11 Oct 2021 03:48:59 UTC
server
cloudflare
x-timer
S1636746547.252210,VS0,VE429
etag
"c8895dde90de43102e6e3d780ab13a7a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad248201a962b7d-FRA
x-cache-hits
0
3c2bf68930cda64d2932c12ed0ed179bc9a495a07d474fd17f0fa437a8db1a22
api.xorhex.com/resource/png/MustangPandaPlugX-45.251.240.55Pivot/ 		72 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.xorhex.com/resource/png/MustangPandaPlugX-45.251.240.55Pivot/3c2bf68930cda64d2932c12ed0ed179bc9a495a07d474fd17f0fa437a8db1a22
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
3c2bf68930cda64d2932c12ed0ed179bc9a495a07d474fd17f0fa437a8db1a22

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:09 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
image/png
Access-Control-Allow-Origin
http://localhost:1313
Connection
keep-alive
Content-Length
73420
cfd08b1517aa177ac41509d7d00a8b5f435451d91867c5040dcf0d6e64589d56
api.xorhex.com/resource/png/MustangPandaPlugX-45.251.240.55Pivot/ 		301 KB
301 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.xorhex.com/resource/png/MustangPandaPlugX-45.251.240.55Pivot/cfd08b1517aa177ac41509d7d00a8b5f435451d91867c5040dcf0d6e64589d56
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
cfd08b1517aa177ac41509d7d00a8b5f435451d91867c5040dcf0d6e64589d56

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:10 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
image/png
Access-Control-Allow-Origin
http://localhost:1313
Connection
keep-alive
Content-Length
307961
64342daad7359f6c732b47e26da9638f73dc719b445c53e641155df92d9318ed
api.xorhex.com/resource/png/mlgetv2/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.xorhex.com/resource/png/mlgetv2/64342daad7359f6c732b47e26da9638f73dc719b445c53e641155df92d9318ed
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
64342daad7359f6c732b47e26da9638f73dc719b445c53e641155df92d9318ed

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:11 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
image/png
Access-Control-Allow-Origin
http://localhost:1313
Connection
keep-alive
Content-Length
21044
897eb737f675e7c63c0f85294f2cd2b8852e9be66ed6bed122f602b59b38f0b7
api.xorhex.com/resource/png/RedDeltaPlugXChangeUp/ 		132 KB
132 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.xorhex.com/resource/png/RedDeltaPlugXChangeUp/897eb737f675e7c63c0f85294f2cd2b8852e9be66ed6bed122f602b59b38f0b7
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
3742596244fef597ff0054ef6f4567c99e2f517d90cf536ae9d84ae2cf67a0f4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:12 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
image/png
Access-Control-Allow-Origin
http://localhost:1313
Connection
keep-alive
Content-Length
134998
fd9f55e0899540787bbdcb011a5b6296834035eecfb8e7a6d14eb3bf0fd7493f
api.xorhex.com/resource/png/MustangPandaPlugX-ReusedMutexandFolder/ 		122 KB
122 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.xorhex.com/resource/png/MustangPandaPlugX-ReusedMutexandFolder/fd9f55e0899540787bbdcb011a5b6296834035eecfb8e7a6d14eb3bf0fd7493f
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
fd9f55e0899540787bbdcb011a5b6296834035eecfb8e7a6d14eb3bf0fd7493f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:12 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
image/png
Access-Control-Allow-Origin
http://localhost:1313
Connection
keep-alive
Content-Length
124436
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/ 		130 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
17729978
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
33250
cf-request-id
0996816b7100004dee2636a000000001
timing-allow-origin
*
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-20801"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c3XwYweFoOzZFcYSdgkelmQF%2FXo%2Fszo%2BdXN%2F2M5JNmaoIUXDqpXooUEzP57dzUNIKE4cstvyJQONdlqDGMy1pU6MWbGa6WuTGzd5g3R8HPzI6m9G4GBrkYPSQGiIRTLOg7EcxJMrp15NdI2Gmsf0SElR"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad248201d392c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
jquery-3.5.1.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.min.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
nginx
etag
W/"5eb09f0f-15d84"
vary
Accept-Encoding
x-hw
1636746547.dop032.ml1.t,1636746547.cds208.ml1.hn,1636746547.cds001.ml1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30879
jquery.fancybox.js
cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/ 		157 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/fancybox/3.5.7/jquery.fancybox.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c836ab144528f3b6748bb49a0ba6fbd3118028282185660067fde9fbcf68e251
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1240621
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
32145
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e58-2739b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZzrqyRdcW5rU7sp8DbXGKMGI%2B65PyzCxP%2FZNe03B08St5t9TJAMJfDJ1VGT%2FPK3HdUqIttzacD5meFsLMr72lRTi5Ml5RY3bmcgVuCW9u1aL%2BKqiyUmony8BAW7l%2B83MvKlK%2BT02vGvDB5d9KbKUZYkN"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6ad248201d4e2c22-FRA
expires
Wed, 02 Nov 2022 19:49:07 GMT
lunr.js
unpkg.com/lunr@2.3.9/
Redirect Chain
  • https://unpkg.com/lunr/lunr.js
  • https://unpkg.com/lunr@2.3.9/lunr.js
97 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/lunr@2.3.9/lunr.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9431726f05c0eae2a6e54dc197709422869f25cad44f2430d2fb7ddae80cc717
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
648615
fly-request-id
01FKQGJDSN2MVW8A8CC3C6851Z
content-encoding
br
vary
Accept-Encoding
last-modified
Wed, 19 Aug 2020 20:25:52 GMT
server
cloudflare
etag
W/"185dc-BNmcBo9ZE+oMHIzDUCK62iHp4xU"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad248206c382c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01FMATT0NYPAJHE90EFHM179AZ
server
cloudflare
age
348
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/lunr@2.3.9/lunr.js
cache-control
public, s-maxage=600, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad248204bfb2c19-FRA
access-control-allow-origin
*
bundlecdn.min.4f231a382f8f0690d1bb94f880ffc1ad613ee9fbd764dd1e79fb10f7092a3494.js
blog.xorhex.com/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/js/bundlecdn.min.4f231a382f8f0690d1bb94f880ffc1ad613ee9fbd764dd1e79fb10f7092a3494.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
4f231a382f8f0690d1bb94f880ffc1ad613ee9fbd764dd1e79fb10f7092a3494
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
1577
x-served-by
cache-fra19168-FRA
last-modified
Mon, 11 Oct 2021 03:48:59 UTC
server
cloudflare
x-timer
S1636746547.245277,VS0,VE252
etag
"7e79c3e34529dac4b8bcb3fb500bd036"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 varnish
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad248201a942b7d-FRA
x-cache-hits
0
add-on.js
blog.xorhex.com/js/ 		1 KB
997 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/js/add-on.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
7980271de5f6979012ba078eb467be93660edddf3b489041d80a6d21f1a1072f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
552
x-served-by
cache-fra19175-FRA
last-modified
Mon, 11 Oct 2021 03:48:59 UTC
server
cloudflare
x-timer
S1636746547.252079,VS0,VE320
etag
"72b77037ab055f3dfb7ebfc4dd9b76a1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 varnish
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad248201a952b7d-FRA
x-cache-hits
0
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ 		59 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=be54eb011a
Requested by
Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/be54eb011a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a12f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)
vary
Accept-Encoding
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
access-control-allow-methods
GET
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 18:53:09 GMT
server
cloudflare
etag
W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5erC8DLgpeX2IvT3ydoO%2F%2BGOlIT13bY324E18hiazoXyaz5saGM31%2FLdheGSFT46dLrRO3ydl9FrayJVVeL9me8ZDzS3qvicP7ZCWXlGU155%2FTDhHxtzeon90HT%2BajKqPBCjZh4yx1HeCpp9d63pVYbSw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
6ad248204f555c0e-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
313P-D1QNdMAe2mmYsP5ex577ZmOPO3avNPB3hjraSYqzfeNa0ReXw==
Ua82pW6439M
www.youtube.com/embed/ Frame FBF4 		60 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/Ua82pW6439M
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
caaf9c7364431b98be8de10226e24fb30227be17753ff8d63d6670cf0c7a8ceb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Fri, 12 Nov 2021 19:49:07 GMT
strict-transport-security
max-age=31536000
report-to
{"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]}
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding
br
server
ESF
x-xss-protection
0
alt-svc
clear
www-player-webp.css
www.youtube.com/s/player/8d287e4d/ Frame FBF4 		335 KB
46 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/www-player-webp.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bf0536a7ccecbfef8793cfc6a61b4454864a4197992ce5ddaa014b48f72bef9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 03:38:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
58252
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
47155
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 03:38:15 GMT
www-embed-player.js
www.youtube.com/s/player/8d287e4d/www-embed-player.vflset/ Frame FBF4 		207 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1e2b9aa4773b8f1dcb906a96a08954329b86b02c1179394f52c984efbcd6ec7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 03:37:19 GMT
content-encoding
br
x-content-type-options
nosniff
age
58308
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
69543
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 03:37:19 GMT
base.js
www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/ Frame FBF4 		2 MB
517 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bf68424ddac709c40c15412cb5cdae3c95f7ddf7ed720b4874e1ffc5e81dfeee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 03:44:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
57881
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
528903
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 03:44:26 GMT
fetch-polyfill.js
www.youtube.com/s/player/8d287e4d/fetch-polyfill.vflset/ Frame FBF4 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 06:57:21 GMT
content-encoding
br
x-content-type-options
nosniff
age
46306
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
2830
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 06:57:21 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame FBF4 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 04:18:33 GMT
x-content-type-options
nosniff
age
55834
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 12 Nov 2022 04:18:33 GMT
id
googleads.g.doubleclick.net/pagead/ Frame FBF4
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
100 B
242 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b270065d36ec3e54fc835eb1190dc55fc26ecd1e52612c76b961bfac71946699
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
clear
content-length
120
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Fri, 12 Nov 2021 19:49:07 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame FBF4 		29 B
463 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:43:00 GMT
x-content-type-options
nosniff
age
367
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
29
x-xss-protection
0
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 12 Nov 2021 19:58:00 GMT
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ 		76 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a12f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

Request headers

Referer
https://blog.xorhex.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
78168
last-modified
Wed, 04 Aug 2021 18:58:24 GMT
server
cloudflare
etag
"a9fd1225fb2cd32320e2b931dca01089"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXV8wFLKnyhsPILVzkOlPa%2B%2FTZjGhWN7oLcLt5h8dhfa7fvoT1KGBTLCvKQ5oITd5RZzLAZkWX7H1Gl8xXdcj0wlsc3ZqcOmvov1bi2Kqrz%2Bec87AOpcPtmjiKDq%2BujTaIP73P8V3klNalSju8mvxwU%2FaA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
6ad24823a8525c0e-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
eYDcnMkAJzT2c-l-tHipSSHugPFyC9TIXvZVzuV7J4w4HYaj3HbrKQ==
free-fa-regular-400.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-regular-400.woff2
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a12f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48fb6f0d8ac464d95cbc2df3ffa7bf5066950898c5581f5133d0565abb7f706b

Request headers

Referer
https://blog.xorhex.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 0b9e85cfe8fe19b385db56d32b4ce802.cloudfront.net (CloudFront)
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
13216
last-modified
Wed, 04 Aug 2021 18:58:24 GMT
server
cloudflare
etag
"b8f1c6a3a94d42b082c29f0b1db8ba95"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fNMoBTO5O04bLcOlci5COv92WvIsZyg3wwmjRuOsj8Exz2MWvBTeDaEab%2F4ITqcMQaDjfr3j7aPczt%2BTYMs%2FdM6BfQ6yFtoprl8GuCqXs0ikBxDwqb%2BltJRBYtCxmzvqnP%2BSIlJ8wBrD95%2B0UPnAe2qFYw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
6ad24823a8555c0e-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
UZtsDxVj_pfhYMncU_7zmrU-oRwc3O7qWx6VzcJbUw0aZ369j2ksGw==
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v22/ 		46 KB
46 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/raleway/v22/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:400,800,900|Source+Sans+Pro:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Thu, 11 Nov 2021 21:19:24 GMT
x-content-type-options
nosniff
age
80983
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
47312
x-xss-protection
0
last-modified
Tue, 29 Jun 2021 19:40:30 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Fri, 11 Nov 2022 21:19:24 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v18/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:400,800,900|Source+Sans+Pro:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 10 Nov 2021 18:38:43 GMT
x-content-type-options
nosniff
age
177024
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
13080
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 18:10:26 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 10 Nov 2022 18:38:43 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v18/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v18/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:400,800,900|Source+Sans+Pro:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7209c26bc245ae1b293f4b9622201b1dc97282229a2e8fcae555f36caa8650e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Wed, 10 Nov 2021 18:35:39 GMT
x-content-type-options
nosniff
age
177208
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
13008
x-xss-protection
0
last-modified
Wed, 10 Nov 2021 18:10:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 10 Nov 2022 18:35:39 GMT
free-fa-brands-400.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ 		75 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-brands-400.woff2
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::ac43:a12f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5be0732ab1cc16692e165a7950810f0c772e400f6a2f63e1026a0b938016813

Request headers

Referer
https://blog.xorhex.com/
Origin
https://blog.xorhex.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront)
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA2-C1
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
76736
last-modified
Wed, 04 Aug 2021 18:58:24 GMT
server
cloudflare
etag
"4f5ec865a8274ab291b6a42b5f70639e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KVK4xRUAJlsmKAniZgB2S2rQrLDKI5JTxTgpHRmOgtYG%2F%2FgAGIsTguod9EaLrunsXUQNCQJGXXoN%2Bop60WweAtFHY7hsRNIFJpS3AwL5zaMzV%2BLzFZ%2BaSjKPy9O%2Fsss%2Fca9yNb9OL1mzefBfM2ByyZ%2FacQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
6ad24823a8585c0e-FRA
access-control-allow-headers
fa-kit-token
x-amz-cf-id
wW0ixbI_X4j2skwiyrczZZJthCnMbCRaTuOSIiSpLiDHlJxs-meLBw==
remote.js
www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/ Frame FBF4 		94 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0e0f871b01bb539a4716e6dc53c8f1e59fb1985d9422169c082e432153db3e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 03:46:54 GMT
content-encoding
br
x-content-type-options
nosniff
age
57733
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
29836
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 03:46:54 GMT
kQof9v-V0VaBK93KCD40uQQ8XZllYzkE_3tmkA6IH3c.js
www.google.com/js/th/ Frame FBF4 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/th/kQof9v-V0VaBK93KCD40uQQ8XZllYzkE_3tmkA6IH3c.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
910a1ff6ff95d156812bddca083e34b9043c5d9965633904ff7b66900e881f77
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 01:05:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
67437
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
13448
x-xss-protection
0
last-modified
Fri, 29 Oct 2021 13:30:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 12 Nov 2022 01:05:10 GMT
embed.js
www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/ Frame FBF4 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a1a158a9cbe6178caba51f4567c57684933795e769f02d00073ed7f9a3ea2804
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 03:47:43 GMT
content-encoding
br
x-content-type-options
nosniff
age
57684
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
7365
x-xss-protection
0
last-modified
Thu, 11 Nov 2021 18:33:51 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 12 Nov 2022 03:47:43 GMT
truncated
/ Frame FBF4 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
-QXUGqX8qTNgDTVX7wcbXLNMDcpj5cATaLmQpjDMMvVUMngDh_3tWV2Jc9M8DDYPEn_aR0AjTw=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame FBF4 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/-QXUGqX8qTNgDTVX7wcbXLNMDcpj5cATaLmQpjDMMvVUMngDh_3tWV2Jc9M8DDYPEn_aR0AjTw=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
442533ffe2580d147bccda4655d645704a3c54d9209dd0a93a1557b9b734262a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
x-content-type-options
nosniff
server
fife
etag
"v1"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="channels4_profile.jpg"
timing-allow-origin
*
alt-svc
clear
content-length
2744
x-xss-protection
0
expires
Sat, 13 Nov 2021 19:49:07 GMT
maxresdefault.webp
i.ytimg.com/vi_webp/Ua82pW6439M/ Frame FBF4 		83 KB
84 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/Ua82pW6439M/maxresdefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3fe269a39335e3e586e54a68f5625a8daf0d6818bee24808f9daa3e637c971aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
x-content-type-options
nosniff
server
sffe
etag
"1621342192"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
clear
content-length
85348
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 12 Nov 2021 21:49:07 GMT
vis-data.min.js
unpkg.com/vis-data@7.1.2/peer/umd/
Redirect Chain
  • https://unpkg.com/vis-data@7.1.2/peer/umd/vis-data.min.js?_=1636746547710
  • https://unpkg.com/vis-data@7.1.2/peer/umd/vis-data.min.js
96 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vis-data@7.1.2/peer/umd/vis-data.min.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f424adf86b4126b6276f8d5cf354356fd790d51bb831d3f15f38609cdd2672bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
1335976
fly-request-id
01FK311VJ4BHKV7YAJZJW59CDS
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"17f9d-MSFpP18Efw4FA2Eta68vMiWKhRU"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad248243b7b2c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
MISS
fly-request-id
01FMAV4MHK8F33G2ESQ3R7B2HF
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/vis-data@7.1.2/peer/umd/vis-data.min.js
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad2482369ee2c19-FRA
vis-network.min.js
unpkg.com/vis-network@9.0.4/peer/umd/
Redirect Chain
  • https://unpkg.com/vis-network@9.0.4/peer/umd/vis-network.min.js?_=1636746547711
  • https://unpkg.com/vis-network@9.0.4/peer/umd/vis-network.min.js
412 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vis-network@9.0.4/peer/umd/vis-network.min.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dae825ae898ebd13182f3bd55d909af2dbd6d7345039a02be480bb61a43736af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:09 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
MISS
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
content-encoding
br
vary
Accept-Encoding
fly-request-id
01FMAV4MW175WCE9JN56QR02MM
server
cloudflare
etag
W/"66e60-vXwmrFFyrXOguTp+HTOQ1dIk0Ao"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad248256de12c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:08 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
MISS
fly-request-id
01FMAV4MSRY8PQQ24QJ4HQ4NE1
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/vis-network@9.0.4/peer/umd/vis-network.min.js
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad24824bc902c19-FRA
vis-timeline-graph2d.min.js
unpkg.com/vis-timeline@7.4.8/peer/umd/
Redirect Chain
  • https://unpkg.com/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js?_=1636746547712
  • https://unpkg.com/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js
401 KB
99 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3e22a6356879492bb4ae6f2fa7069b0aba627a889639e495a88d7ac3b0ee6ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:08 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
1335491
fly-request-id
01FK31GJ5YT5VZ5E75HB5720FR
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"644a2-b5H1OYsaqb+VJPubK8uS4VdgoOg"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad248256ddf2c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:07 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
MISS
fly-request-id
01FMAV4MR30DVJYNNZ4SJYXEZ3
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/vis-timeline@7.4.8/peer/umd/vis-timeline-graph2d.min.js
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad24824cc942c19-FRA
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame FBF4 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
2007
x-xss-protection
0
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview"
vary
Accept-Encoding
report-to
{"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 12 Nov 2021 19:49:08 GMT
generate_204
www.youtube.com/ Frame FBF4 		0
39 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?dGLbeA
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/Ua82pW6439M
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/Ua82pW6439M
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:08 GMT
alt-svc
clear
content-length
0
cast_sender.js
www.gstatic.com/eureka/clank/95/ Frame FBF4 		52 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/eureka/clank/95/cast_sender.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c9ca9fbe90c932d2954e1c8cb18dea47e37035aea6157e8e10a97e70f09402fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 16:58:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
10217
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy
cross-origin
alt-svc
clear
content-length
15249
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 23:31:09 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="cloudview-release"
expires
Sat, 13 Nov 2021 16:58:51 GMT
vis-timeline-graph2d.min.css
unpkg.com/vis-timeline@7.5.0/styles/
Redirect Chain
  • https://unpkg.com/vis-timeline/styles/vis-timeline-graph2d.min.css
  • https://unpkg.com/vis-timeline@7.5.0/styles/vis-timeline-graph2d.min.css
19 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vis-timeline@7.5.0/styles/vis-timeline-graph2d.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5733ee5f63797fe425200aaa59a453ae1f2863f11caf2ef8941882af0782cf20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:08 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
520161
fly-request-id
01FKVB2J7WZ4SR8F1RH3ZR3CY6
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"4d7f-UHoLrxNWHtR5GYEnhNoMeGzBa5E"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad24827da8c2c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:08 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
EXPIRED
fly-request-id
01FMAV4N3YSZ48SZH40ZGDNY8Q
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/vis-timeline@7.5.0/styles/vis-timeline-graph2d.min.css
cache-control
public, s-maxage=600, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad24825fee42c19-FRA
vis-network.min.css
unpkg.com/vis-network@9.1.0/styles/
Redirect Chain
  • https://unpkg.com/vis-network/styles/vis-network.min.css
  • https://unpkg.com/vis-network@9.1.0/styles/vis-network.min.css
215 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/vis-network@9.1.0/styles/vis-network.min.css
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/blog/mustangpandaplugx-1/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fb375710d2f27b75092aa00f2fa9da20d8e67df5fa3f6f036f529c17deea3fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:09 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
age
1229990
fly-request-id
01FK6649608EV9J548DR6ZX1XN
content-encoding
br
vary
Accept-Encoding
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
server
cloudflare
etag
W/"35c33-1TIzx+qfcg6Lu9GM98E6JQB0uso"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
6ad2482defb52c19-FRA

Redirect headers

date
Fri, 12 Nov 2021 19:49:09 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
MISS
fly-request-id
01FMAV4P51E4R2X2343RCWH80K
server
cloudflare
access-control-allow-origin
*
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
location
/vis-network@9.1.0/styles/vis-network.min.css
cache-control
public, s-maxage=600, max-age=60
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6ad2482dbf542c19-FRA
log_event
www.youtube.com/youtubei/v1/ Frame FBF4 		28 B
342 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/8d287e4d/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/Ua82pW6439M
X-YouTube-Client-Version
1.20211110.01.01
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtnTDZXQV9PSUVoWSiziruMBg%3D%3D
X-YouTube-Ad-Signals
dt=1636746547348&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C848%2C477&vis=1&wgl=true&ca_type=image

Response headers

date
Fri, 12 Nov 2021 19:49:10 GMT
content-encoding
br
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
clear
content-length
31
x-xss-protection
0
expires
Fri, 12 Nov 2021 19:49:10 GMT
nodes
api.xorhex.com/intel/ 		8 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.xorhex.com/intel/nodes?g=6a4d9946cc1b6f76a91751d66ff4b6851feb27b44a56f3e3a28776aa8bd8394b
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
aef3d9c7cc232ce10af178379d502080eaed0d32e3e8f8f01975ff9ffe2f0f0a

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.xorhex.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:13 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://blog.xorhex.com
Connection
keep-alive
Content-Length
8219
nodes
api.xorhex.com/intel/ 		27 KB
27 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.xorhex.com/intel/nodes?g=d7def7c0ae75f1d8e86cce59a560715b00c1e11c86d8dd4adecdf04587bce5d2
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
b43b47f08ea3529bf73459aa17de98cd5b94103375f7dcdbeecee1f447f10a42

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.xorhex.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:13 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://blog.xorhex.com
Connection
keep-alive
Content-Length
27148
index.json
blog.xorhex.com/ 		46 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blog.xorhex.com/index.json
Requested by
Host: blog.xorhex.com
URL: https://blog.xorhex.com/js/bundlecdn.min.4f231a382f8f0690d1bb94f880ffc1ad613ee9fbd764dd1e79fb10f7092a3494.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.24.57.253 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
216-24-57-253.ip.win.net
Software
cloudflare /
Resource Hash
094d367671cde9a35ef9fad73f60eeff670c9eef5f5cc1f8b8ac34297a59d820
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blog.xorhex.com/blog/mustangpandaplugx-1/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 19:49:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
age
0
x-cache
MISS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
11070
x-served-by
cache-fra19172-FRA
last-modified
Mon, 11 Oct 2021 03:48:59 UTC
server
cloudflare
x-timer
S1636746553.285375,VS0,VE254
etag
"958ebf2a6810edb3a5deb831f243475f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
via
1.1 varnish
cache-control
public, max-age=0, s-maxage=300
accept-ranges
bytes
cf-ray
6ad24845ebe42b7d-FRA
x-cache-hits
0
edges
api.xorhex.com/intel/ 		17 KB
17 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.xorhex.com/intel/edges?g=6a4d9946cc1b6f76a91751d66ff4b6851feb27b44a56f3e3a28776aa8bd8394b
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
a05433d6e34c8f33736982af1d24fd339f628ca05f4327c9a9c25c95352d1e13

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.xorhex.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:13 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://blog.xorhex.com
Connection
keep-alive
Content-Length
17480
edges
api.xorhex.com/intel/ 		66 KB
66 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.xorhex.com/intel/edges?g=d7def7c0ae75f1d8e86cce59a560715b00c1e11c86d8dd4adecdf04587bce5d2
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.5.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
54.157.58.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-58-70.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
c9eea4a09b4594aa10495bf5ed2217ca2909cdaa67918965ee4baaf4fe88ee7b

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://blog.xorhex.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Fri, 12 Nov 2021 19:49:13 GMT
Via
1.1 vegur
Server
gunicorn
Vary
Origin
Content-Type
application/json
Access-Control-Allow-Origin
https://blog.xorhex.com
Connection
keep-alive
Content-Length
67488

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| FontAwesomeKitConfig function| clearLoading function| clearTables function| addTableCaption function| generateTableHead function| generateTableSingleEntry function| generateTable object| hljs function| $ function| jQuery function| lunr object| toggles object| idx object| resultDetails object| $searchResults object| $searchInput function| registerSearchHandler function| renderSearchResults function| search number| h number| r number| c object| vis object| regeneratorRuntime function| filterCSS function| filterXSS string| path

4 Cookies

Domain/Path Name / Value
.t.co/ Name: muc
Value: 4bd820b2-4b29-48aa-8523-86cbe3164abc
.t.co/ Name: muc-ads
Value: 4bd820b2-4b29-48aa-8523-86cbe3164abc
.youtube.com/ Name: YSC
Value: Qmwx796wwlo
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: gL6WA_OIEhY

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.xorhex.com
blog.xorhex.com
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
ka-f.fontawesome.com
kit.fontawesome.com
static.doubleclick.net
t.co
unpkg.com
www.google.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
104.244.42.133
2001:4de0:ac18::1:a:2a
216.24.57.253
2606:4700:3037::ac43:a12f
2606:4700::6810:125e
2606:4700::6810:7caf
2606:4700::6812:1734
2a00:1450:4001:80e::2001
2a00:1450:4001:812::2003
2a00:1450:4001:812::200a
2a00:1450:4001:813::2002
2a00:1450:4001:813::200e
2a00:1450:4001:813::2016
2a00:1450:4001:827::2004
2a00:1450:4001:828::2006
54.157.58.70
094d367671cde9a35ef9fad73f60eeff670c9eef5f5cc1f8b8ac34297a59d820
1e2b9aa4773b8f1dcb906a96a08954329b86b02c1179394f52c984efbcd6ec7f
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
26aa83c9572c86364137527e26ad481e50be010007677cb07aada5bfd7bf6224
3742596244fef597ff0054ef6f4567c99e2f517d90cf536ae9d84ae2cf67a0f4
3c2bf68930cda64d2932c12ed0ed179bc9a495a07d474fd17f0fa437a8db1a22
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3fe269a39335e3e586e54a68f5625a8daf0d6818bee24808f9daa3e637c971aa
428f1eb7935944229430ac0fdce0033f05d9b8c1c020b87c681dd7a78ab4dd19
442533ffe2580d147bccda4655d645704a3c54d9209dd0a93a1557b9b734262a
48fb6f0d8ac464d95cbc2df3ffa7bf5066950898c5581f5133d0565abb7f706b
4f231a382f8f0690d1bb94f880ffc1ad613ee9fbd764dd1e79fb10f7092a3494
5733ee5f63797fe425200aaa59a453ae1f2863f11caf2ef8941882af0782cf20
5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
64342daad7359f6c732b47e26da9638f73dc719b445c53e641155df92d9318ed
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
711bc66720153ec412b68f6fd2f1538ad17af33ba88d6bdfc89ca15f75b72b57
7209c26bc245ae1b293f4b9622201b1dc97282229a2e8fcae555f36caa8650e8
7980271de5f6979012ba078eb467be93660edddf3b489041d80a6d21f1a1072f
7fb375710d2f27b75092aa00f2fa9da20d8e67df5fa3f6f036f529c17deea3fd
87d5df681512e800b9923f70fa8eac1f6be2b21d101d459e3f8a8306b613975f
910a1ff6ff95d156812bddca083e34b9043c5d9965633904ff7b66900e881f77
93b13c4173ac5a78968ca16acfba3f16667ad6d350d4fddc854c2a21e18ff0fa
9431726f05c0eae2a6e54dc197709422869f25cad44f2430d2fb7ddae80cc717
97ce4e98f3a3be297f48ebd5b771e74928f31754d43324fd795d1cd81cc41b35
a05433d6e34c8f33736982af1d24fd339f628ca05f4327c9a9c25c95352d1e13
a1a158a9cbe6178caba51f4567c57684933795e769f02d00073ed7f9a3ea2804
aef3d9c7cc232ce10af178379d502080eaed0d32e3e8f8f01975ff9ffe2f0f0a
b270065d36ec3e54fc835eb1190dc55fc26ecd1e52612c76b961bfac71946699
b43b47f08ea3529bf73459aa17de98cd5b94103375f7dcdbeecee1f447f10a42
b5be0732ab1cc16692e165a7950810f0c772e400f6a2f63e1026a0b938016813
b8556030a7e2b2d9c901fa025108a0225f897d468fe3b1ab44a8dfe824cf566c
bf0536a7ccecbfef8793cfc6a61b4454864a4197992ce5ddaa014b48f72bef9b
bf2ddcc3febf272ba7b6af7b2848f35e0cddbcd47d2eb50ad9382cf799853b31
bf68424ddac709c40c15412cb5cdae3c95f7ddf7ed720b4874e1ffc5e81dfeee
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
c836ab144528f3b6748bb49a0ba6fbd3118028282185660067fde9fbcf68e251
c9ca9fbe90c932d2954e1c8cb18dea47e37035aea6157e8e10a97e70f09402fe
c9eea4a09b4594aa10495bf5ed2217ca2909cdaa67918965ee4baaf4fe88ee7b
caaf9c7364431b98be8de10226e24fb30227be17753ff8d63d6670cf0c7a8ceb
cfd08b1517aa177ac41509d7d00a8b5f435451d91867c5040dcf0d6e64589d56
d0e0f871b01bb539a4716e6dc53c8f1e59fb1985d9422169c082e432153db3e5
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
dae825ae898ebd13182f3bd55d909af2dbd6d7345039a02be480bb61a43736af
db29d76914ae9846348da5bcb40738b5e17991be4877ec3c591fa4f64984cd17
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
df168d10c9783cebfdae3e74ccb35a1df960ebba76c69c2a119c202d7093d8a0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
f3e22a6356879492bb4ae6f2fa7069b0aba627a889639e495a88d7ac3b0ee6ca
f424adf86b4126b6276f8d5cf354356fd790d51bb831d3f15f38609cdd2672bc
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
fd9f55e0899540787bbdcb011a5b6296834035eecfb8e7a6d14eb3bf0fd7493f