redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://redcanary.com/blog/lateral-movement-winrm-wmi/
Effective URL:
https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Submission: On November 18 via api (November 18th 2024, 7:33:18 pm UTC) from US — Scanned from US

Summary HTTP 149 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 46 IPs in 3 countries across 32 domains to perform 149 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 672389.
TLS certificate: Issued by R11 on November 11th 2024. Valid for: 3 months.

This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 27	104.198.136.223 104.198.136.223	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
11	2606:4700::68... 2606:4700::6812:572a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:817::200a	15169 (GOOGLE) (GOOGLE)
6	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	152.199.2.76 152.199.2.76	15133 (EDGECAST) (EDGECAST)
4	2607:f8b0:400... 2607:f8b0:4006:80f::2008	15169 (GOOGLE) (GOOGLE)
2	104.18.17.5 104.18.17.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.92.208.16 52.92.208.16	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.71.178.49 104.71.178.49	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2607:f8b0:400... 2607:f8b0:4006:81e::200a	15169 (GOOGLE) (GOOGLE)
12	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2606:4700::68... 2606:4700::6812:1eb0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.250.65.227 142.250.65.227	15169 (GOOGLE) (GOOGLE)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
4	2607:f8b0:400... 2607:f8b0:4006:824::200e	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c17::9d	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:821::2002	15169 (GOOGLE) (GOOGLE)
2	23.206.172.17 23.206.172.17	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	142.250.80.68 142.250.80.68	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:141b:b00... 2600:141b:b000::173b:fbd0	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
2	31.13.80.12 31.13.80.12	32934 (FACEBOOK) (FACEBOOK)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	68.67.179.87 68.67.179.87	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2600:9000:23c... 2600:9000:23ca:d400:5:7a81:86c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.193.140 151.101.193.140	54113 (FASTLY) (FASTLY)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
1	142.250.65.194 142.250.65.194	15169 (GOOGLE) (GOOGLE)
4 6	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	142.251.35.170 142.251.35.170	15169 (GOOGLE) (GOOGLE)
1	104.18.16.5 104.18.16.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	162.159.140.229 162.159.140.229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	31.13.80.36 31.13.80.36	32934 (FACEBOOK) (FACEBOOK)
1	23.206.172.12 23.206.172.12	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
1	2600:141b:1c0... 2600:141b:1c00:2e::17d1:48d1	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
14	23.33.42.88 23.33.42.88	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2	75.2.108.141 75.2.108.141	16509 (AMAZON-02) (AMAZON-02)
3	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
8	34.145.201.140 34.145.201.140	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.250.65.238 142.250.65.238	() ()
149	46

27 104.198.136.223 (Council Bluffs, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 223.136.198.104.bc.googleusercontent.com

redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:572a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

resource.redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 152.199.2.76 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80f::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.17.5 (None, )

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
customer-assets.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.92.208.16 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2.amazonaws.com

s3-us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.71.178.49 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-71-178-49.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1eb0 (United States)

ASN13335 (CLOUDFLARENET, US)

tracking.g2crowd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.65.227 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

003-yru-314.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:824::200e (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c17::9d (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:821::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.206.172.17 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-206-172-17.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.80.68 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:b000::173b:fbd0 (Newark, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.80.12 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-yyz1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.67.179.87 (North Bergen, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:23ca:d400:5:7a81:86c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.193.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

pixel-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.194 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.35.170 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.16.5 (None, )

ASN13335 (CLOUDFLARENET, US)

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.140.229 (None, )

ASN13335 (CLOUDFLARENET, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.80.36 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-yyz1.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.206.172.12 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-206-172-12.deploy.static.akamaitechnologies.com

c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:2e::17d1:48d1 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.33.42.88 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-33-42-88.deploy.static.akamaitechnologies.com

b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.2.108.141 (United States)

ASN16509 (AMAZON-02, US)
PTR: afe865822f884bb48.awsglobalaccelerator.com

eps.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.145.201.140 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 140.201.145.34.bc.googleusercontent.com

r4.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.238 (None, )

ASN- ()

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	redcanary.com 1 redirects redcanary.com — Cisco Umbrella Rank: 672389 resource.redcanary.com	1 MB
20	6sc.co j.6sc.co — Cisco Umbrella Rank: 5557 c.6sc.co — Cisco Umbrella Rank: 6739 ipv6.6sc.co — Cisco Umbrella Rank: 5633 b.6sc.co — Cisco Umbrella Rank: 3603 eps.6sc.co — Cisco Umbrella Rank: 9024	25 KB
20	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 3020 r4.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 146167	215 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 329	165 KB
7	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 333 www.linkedin.com — Cisco Umbrella Rank: 676 px4.ads.linkedin.com — Cisco Umbrella Rank: 7032	4 KB
6	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182 googleads.g.doubleclick.net — Cisco Umbrella Rank: 43	671 B
6	google.com analytics.google.com — Cisco Umbrella Rank: 142 www.google.com — Cisco Umbrella Rank: 3
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	360 KB
4	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 9821	26 KB
4	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415 fonts.googleapis.com — Cisco Umbrella Rank: 29	32 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
3	adnxs.com 2 redirects secure.adnxs.com — Cisco Umbrella Rank: 495	3 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 359	15 KB
3	gstatic.com fonts.gstatic.com	43 KB
3	qualified.com js.qualified.com — Cisco Umbrella Rank: 17504 app.qualified.com — Cisco Umbrella Rank: 17538 customer-assets.qualified.com	655 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	214 B
2	reddit.com pixel-config.reddit.com — Cisco Umbrella Rank: 2010 alb.reddit.com — Cisco Umbrella Rank: 1418	761 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 192	75 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1095	13 KB
2	g2crowd.com tracking.g2crowd.com — Cisco Umbrella Rank: 8407	2 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3671	6 KB
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 991	724 B
1	t.co t.co — Cisco Umbrella Rank: 904	632 B
1	ml-api.io attr.ml-api.io — Cisco Umbrella Rank: 20251	281 B
1	ml-attr.com 1 redirects s.ml-attr.com — Cisco Umbrella Rank: 17837	278 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 1016	16 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 831	14 KB
1	mktoresp.com 003-yru-314.mktoresp.com	318 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 14108	203 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 514	306 B
1	amazonaws.com s3-us-west-2.amazonaws.com	41 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	2 KB
149	32

	Domain	Requested by
27	redcanary.com	1 redirects redcanary.com cdn.bizible.com
14	b.6sc.co	redcanary.com
12	dev.visualwebsiteoptimizer.com	redcanary.com cdn.bizible.com
11	cdn.cookielaw.org	redcanary.com cdn.cookielaw.org
8	r4.visualwebsiteoptimizer.com	cdn.bizible.com
6	resource.redcanary.com	redcanary.com resource.redcanary.com js.qualified.com
5	px.ads.linkedin.com	3 redirects cdn.bizible.com
5	analytics.google.com	www.googletagmanager.com dev.visualwebsiteoptimizer.com
4	www.googletagmanager.com	redcanary.com www.googletagmanager.com
4	cdn.bizible.com	redcanary.com cdn.bizible.com
3	www.google-analytics.com	www.googletagmanager.com cdn.bizible.com
3	secure.adnxs.com	2 redirects cdn.bizible.com
3	bat.bing.com	www.googletagmanager.com bat.bing.com redcanary.com
3	td.doubleclick.net	www.googletagmanager.com
3	fonts.gstatic.com	fonts.googleapis.com
3	fonts.googleapis.com	redcanary.com js.qualified.com
2	eps.6sc.co	cdn.bizible.com
2	www.facebook.com	redcanary.com
2	connect.facebook.net	redcanary.com connect.facebook.net
2	www.redditstatic.com	www.googletagmanager.com cdn.bizible.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	stats.g.doubleclick.net	www.googletagmanager.com
2	tracking.g2crowd.com	redcanary.com tracking.g2crowd.com
2	munchkin.marketo.net	redcanary.com munchkin.marketo.net
1	customer-assets.qualified.com
1	ipv6.6sc.co	cdn.bizible.com
1	c.6sc.co	cdn.bizible.com
1	analytics.twitter.com	redcanary.com
1	t.co	redcanary.com
1	px4.ads.linkedin.com	redcanary.com
1	www.linkedin.com	1 redirects
1	app.qualified.com	js.qualified.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	alb.reddit.com	redcanary.com
1	pixel-config.reddit.com	cdn.bizible.com
1	attr.ml-api.io	redcanary.com
1	s.ml-attr.com	1 redirects
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.google.com	www.googletagmanager.com
1	003-yru-314.mktoresp.com	munchkin.marketo.net
1	cdn.bizibly.com	redcanary.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	s3-us-west-2.amazonaws.com	redcanary.com
1	cdnjs.cloudflare.com	redcanary.com
1	js.qualified.com	redcanary.com
1	ajax.googleapis.com	redcanary.com
149	47

This site contains links to these domains. Also see Links.

Domain
resource.redcanary.com
help.redcanary.com
twitter.com
www.linkedin.com
www.youtube.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
redcanary.com R11	`2024-11-11` - `2025-02-09`	3 months	crt.sh
cookielaw.org WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
resource.redcanary.com Cloudflare Inc ECC CA-3	`2024-03-02` - `2024-12-31`	10 months	crt.sh
io.bizible.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-07` - `2025-07-08`	a year	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
qualified.com WE1	`2024-11-02` - `2025-01-31`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.s3-us-west-2.amazonaws.com Amazon RSA 2048 M01	`2024-09-14` - `2025-08-29`	a year	crt.sh
geolocation.onetrust.com WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-22` - `2025-10-24`	a year	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2024-06-29` - `2025-07-31`	a year	crt.sh
g2crowd.com WE1	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-15` - `2025-09-15`	a year	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
6sc.co R10	`2024-09-23` - `2024-12-22`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-06` - `2025-04-03`	6 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-25` - `2025-06-24`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-08-27` - `2024-11-25`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-10-13` - `2025-04-11`	6 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-10-14` - `2025-04-14`	6 months	crt.sh
t.co E5	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-07` - `2025-10-06`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
eps.6sc.co Amazon RSA 2048 M03	`2024-08-27` - `2025-09-25`	a year	crt.sh

This page contains 7 frames:

Primary Page: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Frame ID: A8AD0172C3C5D158EB4545D74BB2D3FE
Requests: 145 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-T3K4MTNQJN&gacid=1249598163.1731958384&gtm=45je4be0v874113835za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=286747454
Frame ID: 15E208FD3CF521E84C0EEFDEA0A80C10
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-S6W6WXK4G8&gacid=1249598163.1731958384&gtm=45je4be0v874113835za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=2048956187
Frame ID: 2DD3951A226C723E3BC739D599DABBDA
Requests: 1 HTTP requests in this frame

Frame: https://resource.redcanary.com/index.php/form/XDFrame
Frame ID: F57F985DD6AF9132500DBA0ECBF282A0
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fredcanary.com
Frame ID: F6FEC41469C3FAE97B95A2FB749E5211
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/759876114?random=1731958384209&cv=11&fst=1731958384209&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4be0v9103488584z8813277038za201zb813277038&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&hn=www.googleadservices.com&frm=0&tiba=Lateral%20Movement%20Using%20WinRM%20and%20WMI&npa=0&pscdl=noapi&auid=859653460.1731958384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 1DAF18529A3349768380F43CFD3EA7EA
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=91790cc4-6d49-49e6-a8e0-b2614bbef4d9
Frame ID: 5AD4CBE1159F15F4603E12EB7573DBAE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lateral Movement Using WinRM and WMI

Page URL History Show full URLs

https://redcanary.com/blog/lateral-movement-winrm-wmi/ HTTP 301
https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

149
Requests

96 %
HTTPS

35 %
IPv6

32
Domains

47
Subdomains

46
IPs

3
Countries

2854 kB
Transfer

17464 kB
Size

53
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf
Title: 2022 Threat Detection Report PDF

Search URL Search Domain Scan URL

URL: https://resource.redcanary.com/rs/003-YRU-314/images/2022TDR_ExecutiveSummary.pdf
Title: 2022 Executive Summary PDF

Search URL Search Domain Scan URL

URL: https://help.redcanary.com/hc/en-us
Title: Customer Help Center

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/&text=Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&title=Lateral+Movement+Using+WinRM+and+WMI&summary=Attackers+frequently+move+laterally+with+tools+included+in+Windows.+Go+behind+the+scenes+of+an+attack+using+WinRM+and+WMI.&source=RedCanary

Search URL Search Domain Scan URL

URL: https://twitter.com/redcanary

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/redcanary/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/@RedCanary

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://redcanary.com/blog/lateral-movement-winrm-wmi/ HTTP 301
https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=redcanary.com&pId=7184709002420862473

Request Chain 106

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2 HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1731958384529%26li_adsId%3Dbd16d179-0879-436f-ad10-172beba7d2d0%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fthreat-detection%252Flateral-movement-winrm-wmi%252F%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKBCWFNeK8lXQAAAZNAw6jJj0NIib7gxV-pYXjkeOfTFfYWqfMVLFORl363t6I7VcAnAQ

149 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Redirect Chain

https://redcanary.com/blog/lateral-movement-winrm-wmi/
https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

341 KB
61 KB

154ms
153ms

Document
text/html

104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

a1fbda5caa3550449af82c07cba1d79dc6782cf97f1c21dea18d18a820a4c98f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: max-age=600, must-revalidate
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Mon, 18 Nov 2024 19:33:01 GMT
feature-policy: microphone 'none'; geolocation 'none'
link: <https://redcanary.com/?p=6932>; rel=shortlink
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache: HIT: 3
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: deny
x-permitted-cross-domain-policies: master-only
x-powered-by: WP Engine
x-xss-protection: 1; mode=block

Redirect headers

cache-control: max-age=600, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Mon, 18 Nov 2024 19:33:01 GMT
expires: Mon, 18 Nov 2024 20:31:22 GMT
feature-policy: microphone 'none'; geolocation 'none'
location: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
referrer-policy: strict-origin-when-cross-origin
server: nginx
vary: Accept-Encoding
x-cache: HIT: 3
x-cache-group: normal
x-cacheable: non200
x-content-type-options: nosniff
x-frame-options: deny
x-permitted-cross-domain-policies: master-only
x-powered-by: WP Engine
x-redirect-by: redirection
x-xss-protection: 1; mode=block

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 22 KB
8 KB 134ms
46ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: Vo/d0f3ZefkwyML/PnJnjg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DD04E9B806368E
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 45389
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:01 GMT
content-type: application/javascript
last-modified: Thu, 14 Nov 2024 20:20:01 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: ea6aeb6f-401e-00e5-1231-37817d000000
cf-ray: 8e4a63ce8ce12209-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7212
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ 85 KB
30 KB 219ms
71ms Script
text/javascript 2607:f8b0:4006:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
age: 280320
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Sat, 15 Nov 2025 13:41:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 13:41:01 GMT
last-modified: Tue, 12 Sep 2023 02:38:22 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30462
x-xss-protection: 0
server: sffe

GET
H2 200 forms2.min.js Show response
resource.redcanary.com/js/forms2/js/ 199 KB
67 KB 217ms
68ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/js/forms2/js/forms2.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=63113904
cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "2d803a3-31b73-6265f6525d19f"
age: 2737
x-content-type-options: nosniff
cf-ray: 8e4a63ceea97a51b-MIA
expires: Mon, 18 Nov 2024 23:33:01 GMT
date: Mon, 18 Nov 2024 19:33:01 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Fri, 08 Nov 2024 04:43:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 67 KB
25 KB 161ms
32ms Script
application/x-javascript 152.199.2.76
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.2.76 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mid/877C) /

Resource Hash

be3efb305c8998b5773f331a735243d5112df20d1e6a90d859ee3b65dc77bbc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: max-age=86400
content-encoding: gzip
etag: "961cde537134db1:0"
age: 18527
accept-ranges: bytes
x-cache: HIT
content-length: 25392
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/x-javascript
last-modified: Mon, 11 Nov 2024 19:38:48 GMT
server: ECS (mid/877C)
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 446 KB
137 KB 261ms
118ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6cdeee2508de3768e7bd7966db999cfcd409ffac4031db8d72d49c9054fea627

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 18 Nov 2024 19:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 140026
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 qualified.js Show response
js.qualified.com/ 1 MB
245 KB 162ms
60ms Script
text/javascript 104.18.17.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44baa21ce9a58ec4912289526b121545065853d4f939b6b62c048144a9af52da

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-request-id: 9cfd63cb-ab02-4f70-be42-b8bbd63df988
content-encoding: gzip
cf-cache-status: HIT
etag: W/"47e9bf9aca26d34886c08b670b895489"
age: 34371
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
x-cache: miss
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/javascript; charset=utf-8
vary: Accept,Accept-Encoding
x-runtime: 0.049259
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400
x-envoy-upstream-service-time: 74
referrer-policy: strict-origin-when-cross-origin
x-download-options: noopen
cf-ray: 8e4a63d0de887455-MIA
x-xss-protection: 1; mode=block
server: cloudflare

GET
H3 200 jquery.matchHeight-min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/ 3 KB
2 KB 114ms
54ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/jquery.matchHeight-min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03ec3-d34"
age: 235663
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ydinwKD8Q7aRKHeVsDEmHoPByP%2F%2F9iMSTN3lAKu%2BWfh7lP6Hd%2B3xZlR25F50e7bkTaZPmt4Ao7D9R6%2FA%2BWoI8YYjKwuQnZM5Aep44bnOpRdKMNImnpJ1M68wCtC3spbtV9olBvfW"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 08 Nov 2025 19:33:01 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 19:33:01 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:47 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e4a63ce68348dd6-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1221
server: cloudflare

GET
H/1.1 200
OK teknkl-formsplus-1.0.5.js Show response
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/ 41 KB
41 KB 367ms
128ms Script
application/x-js 52.92.208.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: HTTP/1.1
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 52.92.208.16 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2.amazonaws.com
Software: AmazonS3 /
Resource Hash: 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Cache-Control: public
ETag: "bab0c2b3523f8244564b675fe34db610"
x-amz-version-id: OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
x-amz-request-id: E37PF3H5X30XWC8A
Accept-Ranges: bytes
Content-Length: 41617
Date: Mon, 18 Nov 2024 19:33:03 GMT
Last-Modified: Thu, 26 Apr 2018 08:20:46 GMT
Content-Type: application/x-js
Server: AmazonS3
x-amz-id-2: swpSg9dx1XMotWukfUAhKLgXmgWoBVRNHplXAvxtN6JrrZG90Jv12otZ6Zku9LArAUxCZZGrVcY=

GET
H2 200 autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js Show response
redcanary.com/wp-content/cache/autoptimize/js/ 262 KB
76 KB 87ms
84ms Script
application/javascript 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

18b368af8e8679b39c6fbbdde36542f3fc345bc9230a35cd1bd06595c1e73608

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"672bc673-4165d"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Wed, 06 Nov 2024 19:41:39 GMT

GET
H2 200 40393661-0639-4e13-9774-ba9e2ae459fa.json Show response
cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/ 5 KB
2 KB 137ms
57ms XHR
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/40393661-0639-4e13-9774-ba9e2ae459fa.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e7669e92e0d052b6940b1c108fe488fc344e33e92615ee396c98573ea7e94c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: Of+LW11tRgwbWqX5gaZ5fw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCF76BB61C7510
age: 75282
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 19 Nov 2024 19:33:02 GMT
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/json
last-modified: Mon, 28 Oct 2024 16:15:16 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: a3f6edea-001e-00c0-2e54-2919ce000000
cf-ray: 8e4a63cf6ed86c87-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1782
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 164ms
89ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
accept: application/json
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
access-control-allow-methods: GET, OPTIONS
cf-ray: 8e4a63d038dc6dd7-MIA
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 255ms
79ms Script
application/x-javascript 104.71.178.49
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.71.178.49 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-71-178-49.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Content-Encoding: gzip
ETag: "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 741
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date: Mon, 18 Nov 2024 19:33:02 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 13 Nov 2024 02:44:39 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 392 KB
124 KB 278ms
137ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0b77cd22751607c04664a5da63f0746bda0181d9ef2da8ba3791dd5227a532d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Mon, 18 Nov 2024 19:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 18 Nov 2024 18:32:11 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 126654
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css
fonts.googleapis.com/ 8 KB
1 KB 236ms
88ms Stylesheet
text/css 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 18 Nov 2024 19:32:34 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 29 KB
9 KB 180ms
101ms XHR
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=906194&u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&vn=2.1&x=true
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gsc1 /
Resource Hash: ae39f3fb5239a3103de720c324ee42c6f1c50b8ddbfb6cf06dcf89ca482a511c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://redcanary.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: gsc1

GET
H2 200 autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css
redcanary.com/wp-content/cache/autoptimize/css/ 5 MB
250 KB 163ms
161ms Stylesheet
text/css 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"672bc674-53ed07"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Wed, 06 Nov 2024 19:41:40 GMT

GET
H2 200 5354.js Show response
tracking.g2crowd.com/attribution_tracking/conversions/ 2 KB
2 KB 196ms
108ms Script
text/javascript 2606:4700::6812:1eb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/&e=

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5accbeb22a5e5fc1b0663d3c1fa19fccf9f589c7aecdba876a11d013ba1deb5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: br
x-permitted-cross-domain-policies: none
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/javascript;charset=UTF-8
content-disposition: inline
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
referrer-policy: no-referrer
x-download-options: noopen
cf-ray: 8e4a63d0df066dcb-MIA
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1
server: cloudflare

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c3bb2affbcd85352be47fb9f5869bbbdbfd911e56a1f0ac3fda267bf83f2029

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c6b1061241d9ba3ebe56f9bed639fe79d332c9719445e64826427efabb0b6a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d508e8d84799586df292dc06e23cf3dedfe8d4f4675230bcec7279cec4c724a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a800871b05a2d7c53fbb4159f1a7dbb510691639988a81695a50fb19bd04d92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 69 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7df14128159d5a2757314dd6cbdf8d5351d9ac300c9cf93919a5e595d34e9cf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 350 B
581 B 199ms
198ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"5c76b1e9-15e"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Wed, 27 Feb 2019 15:51:05 GMT

GET
H2 200 CanarySans-Text-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 155ms
153ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-700.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06305-5acc"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23244
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 CanarySans-Text-400.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 155ms
154ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-400.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06303-5a48"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23112
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:23 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 getForm Show response
resource.redcanary.com/index.php/form/ 9 KB
2 KB 201ms
200ms Script
application/javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&callback=jQuery37107117523957874723_1731958382055&_=1731958382056
Requested by: Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 790edac9099268352d0c8a6852772b20026c98cafae6ccd74ed05fd6e61a6954

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cf-ray: 8e4a63d0ddd5a51b-MIA
cached: true
content-encoding: gzip
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202409.2.0/ 461 KB
112 KB 48ms
46ms Script
application/javascript 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: uGd5VTJp/PFmoOURmUW/IQ==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF719E1819D6B
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 26560
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/javascript
last-modified: Mon, 28 Oct 2024 06:29:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 2d9cf310-d01e-00c2-7ad8-341b34000000
cf-ray: 8e4a63d0d8132209-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 114311
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 worker-099913a84ceb27d206f0a53d1546a6f5br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 264 KB
64 KB 90ms
41ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-099913a84ceb27d206f0a53d1546a6f5br.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: b474f45de8cb58c109ac4f0317e9844a524e857dda61dce742b8f535964572cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=Oo/Pfg==, md5=qMs2DlAj53V2APbzkbTVMw==
etag: "a8cb360e5023e7757600f6f391b4d533"
age: 36743
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 65225
date: Mon, 18 Nov 2024 09:20:39 GMT
last-modified: Mon, 18 Nov 2024 08:09:27 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC6B68OMJNCT-f58auIY1uJc4nseuHDrU52laF6DYQQMkGRyqIXY8YpbM3oflP-jggO_pzhuq9n3Og
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731917367486486
content-length: 65225
content-language: en
server: UploadServer

GET
H3 200 va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 276 KB
71 KB 91ms
43ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4dc938ac1478b3c05be5e7ce8a59481f532743dbaf1641cca4445786f28c500b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=yxmZrQ==, md5=A06VLJiKmqk1uDWpPm/E+w==
etag: "034e952c988a9aa935b835a93e6fc4fb"
age: 36740
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 73122
date: Mon, 18 Nov 2024 09:20:42 GMT
last-modified: Mon, 18 Nov 2024 08:09:54 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC4yMaaqKlUFV-08MZV4m5QS4H1qCSosOrRXXQ7QhCwIScmrqpTgodCCVMHMtmWIR9BmD28
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731917394426091
content-length: 73122
content-language: en
server: UploadServer

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
146 B 64ms
61ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=906194&d=redcanary.com&u=D4384814343C335266B5080058EE981ED&h=3d9e170e12143f68f0e9ef5249cfc887&t=false

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: public, max-age=43200
x-content-type-options: nosniff
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Mon, 18 Nov 2024 19:33:01 GMT
content-type: image/gif
server: gnv02c

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7078-83d3-8e4af4a63c17/ 85 KB
16 KB 68ms
67ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7078-83d3-8e4af4a63c17/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52562aefbf6c058669afe4e04bdb80eeb12164dbe1f446f28e98b5c308271c92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: Sa9r1ujgUNuXSeFLAn024A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
cf-cache-status: HIT
etag: 0x8DCF76BBBA6A73D
age: 75281
x-ms-lease-status: unlocked
x-content-type-options: nosniff
x-ms-version: 2009-09-19
expires: Tue, 19 Nov 2024 19:33:02 GMT
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/json
last-modified: Mon, 28 Oct 2024 16:15:26 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin, cross-origin
x-ms-request-id: 3ce5e639-f01e-0012-4c54-29a796000000
cf-ray: 8e4a63d188a66c87-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16314
x-ms-blob-type: BlockBlob
server: cloudflare

POST
H2 200 assign
tracking.g2crowd.com/attribution_tracking/conversions/ 0
0 104ms
83ms Ping
text/html 2606:4700::6812:1eb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.g2crowd.com/attribution_tracking/conversions/assign
Requested by: Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/&e=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycJXKUoNxKqoHq0Zu
Referer: https://redcanary.com/

Response headers

GET
H2 200 css
fonts.googleapis.com/ 8 KB
0 1ms
1ms Stylesheet
text/css 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 18 Nov 2024 19:32:34 GMT
x-frame-options: SAMEORIGIN
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 15 KB
15 KB 151ms
72ms Font
font/woff2 142.250.65.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f3.1e100.net

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/

Response headers

age: 344611
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 14 Nov 2025 19:49:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Nov 2024 19:49:31 GMT
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14892
x-xss-protection: 0
server: sffe

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 145ms
67ms Font
font/woff2 142.250.65.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f3.1e100.net

Software

sffe /

Resource Hash

0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/

Response headers

age: 344181
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 14 Nov 2025 19:56:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 14 Nov 2024 19:56:41 GMT
last-modified: Thu, 01 Jun 2023 22:52:57 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14712
x-xss-protection: 0
server: sffe

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 182ms
105ms Font
font/woff2 142.250.65.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.227 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f3.1e100.net

Software

sffe /

Resource Hash

c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/

Response headers

age: 245943
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sat, 15 Nov 2025 23:13:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 15 Nov 2024 23:13:59 GMT
last-modified: Thu, 01 Jun 2023 22:52:58 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14780
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 74ms
67ms Script
application/x-javascript 104.71.178.49
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.71.178.49 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-71-178-49.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Cache-Control: max-age=8640000
Content-Encoding: gzip
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Connection: keep-alive
Expires: Wed, 26 Feb 2025 19:33:02 GMT
Accept-Ranges: bytes
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Length: 4741
Date: Mon, 18 Nov 2024 19:33:02 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 forms2.css
resource.redcanary.com/js/forms2/css/ 13 KB
3 KB 59ms
58ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/js/forms2/css/forms2.css

Requested by

Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "28e04f9-3437-62370c030d900"
age: 6725
x-content-type-options: nosniff
cf-ray: 8e4a63d45bafa51b-MIA
expires: Mon, 18 Nov 2024 23:33:02 GMT
accept-ranges: bytes
content-length: 2623
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 forms2-theme-plain.css
resource.redcanary.com/js/forms2/css/ 828 B
331 B 79ms
78ms Stylesheet
text/css 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "28e0500-33c-62370c030d900"
age: 6725
x-content-type-options: nosniff
cf-ray: 8e4a63d45bb1a51b-MIA
expires: Mon, 18 Nov 2024 23:33:02 GMT
accept-ranges: bytes
content-length: 246
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css
last-modified: Tue, 01 Oct 2024 21:10:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ipv
cdn.bizible.com/ 43 B
304 B 37ms
36ms Image
image/gif 152.199.2.76
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=d20d8f441ccb4a19e6178566175c5d94&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&_biz_t=1731958382210&_biz_i=Lateral%20Movement%20Using%20WinRM%20and%20WMI&_biz_n=0&a=redcanary.com&rnd=25573&cdn_o=a&_biz_z=1731958382785

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.2.76 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mid/877D) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 18527
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: Image/GIF
last-modified: Mon, 18 Nov 2024 14:24:15 GMT
server: ECS (mid/877D)

GET
H2 200 u
cdn.bizibly.com/ 43 B
203 B 63ms
40ms Image
image/gif 152.199.2.76
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizibly.com/u?_biz_u=d20d8f441ccb4a19e6178566175c5d94&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&_biz_t=1731958382789&_biz_i=Lateral%20Movement%20Using%20WinRM%20and%20WMI&a=redcanary.com&rnd=328345&cdn_o=a&_biz_z=1731958382789

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.2.76 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mid/877B) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 18526
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: Image/GIF
last-modified: Mon, 18 Nov 2024 14:24:16 GMT
server: ECS (mid/877B)

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/ 13 KB
3 KB 51ms
49ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: CDHNBOyaHPNE3EDr/Gzy5w==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF719DDD38B75
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 61976
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/json
last-modified: Mon, 28 Oct 2024 06:29:24 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 789a506c-401e-006d-669b-3039a4000000
cf-ray: 8e4a63d4de226c87-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3003
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/ 62 KB
13 KB 44ms
43ms Fetch
application/json 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b299beb73a789a8d7b52742818aa6ca138181937696f93189bd6051cc6db65f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: UzGP3R1Xe+DFt1ED28NmJw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
content-encoding: gzip
x-ms-version: 2009-09-19
etag: 0x8DCF719DF30F751
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 75280
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: application/json
last-modified: Mon, 28 Oct 2024 06:29:27 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: d00c6dd1-e01e-00c1-6254-291833000000
cf-ray: 8e4a63d4de2a6c87-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12723
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202409.2.0/assets/ 24 KB
4 KB 52ms
51ms Fetch
text/css 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: A9jekd5UoO8SyzJ6LiStug==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 75280
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css
last-modified: Mon, 28 Oct 2024 06:29:35 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: f24689cd-a01e-00e4-4f54-298080000000
cf-ray: 8e4a63d4de2c6c87-MIA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET c628ce48-e7bd-4803-a00a-cf2e4890964f
https://redcanary.com/ Frame 0
0

GET
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 70ms
69ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=D4384814343C335266B5080058EE981ED&s=1731958382&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22en-us%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1731958382900%2C%22tO%22%3A10%2C%22tz%22%3A%22Pacific%2FHonolulu%22%7D&cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1731958382901&v=d1d41ec36

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: image/gif
server: gnv02c

GET
H2 200 autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css
redcanary.com/wp-content/cache/autoptimize/css/ 5 MB
0 0ms
0ms Stylesheet
text/css 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"672bc674-53ed07"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: text/css
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Wed, 06 Nov 2024 19:41:40 GMT

GET
H2 200 CanarySans-Display-400.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 196ms
182ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-400.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

c8794253f4669bc181f3401651637f6a14f68ea3ffd1bd18a8e46abaac6308ac

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f062fc-5b10"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23312
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:16 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 CanarySans-Text-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
0 1ms
1ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-700.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06305-5acc"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23244
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 CanarySans-Display-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 197ms
184ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-700.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

df064dd6edad0cdc26f0a3abc83b8d5d5b173a41d6b88d8d242823055da2124d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f062fe-5b1c"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23324
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:18 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 globe-white-right.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 259 KB
260 KB 79ms
77ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "5c76b1ef-40da2"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 265634
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/png
last-modified: Wed, 27 Feb 2019 15:51:11 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 CanarySans-Display-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 198ms
185ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-300.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

52ce30c1ca4a370f850fadf51868d1792a6e6a81f9488f67b993cc7d2921d187

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f062fb-5acc"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23244
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:15 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 161 B
435 B 226ms
225ms Image
image/svg+xml 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"61394254-a1"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/svg+xml
vary: Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Wed, 08 Sep 2021 23:08:04 GMT

GET
H2 200 CanarySans-Text-400.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
0 0ms
0ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-400.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06303-5a48"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23112
date: Mon, 18 Nov 2024 19:33:02 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:23 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 CanarySans-Text-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 22 KB
23 KB 196ms
183ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-300.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

6a2fae6141cd3c337ae20368ec6c6d16bcd1774b42c9cf6ef2b79f4ce7a67710

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06302-5998"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 22936
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:22 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
333 B 71ms
64ms Script
text/javascript 152.199.2.76
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.bizible.com/xdc.js?_biz_u=d20d8f441ccb4a19e6178566175c5d94&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.11.11&a=redcanary.com

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.2.76 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mid/877D) /

Resource Hash

a5cecf81dae3770dfa534b64e6883d1a26be92a8c2c31ad85f1dd21d6987e3f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: private, must-revalidate, max-age=21600
content-encoding: gzip
etag: 2D9CC141
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 217
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: ECS (mid/877D)

GET
H3 200 nc-61dc49ec658dadeff970ff1e789f1da4br.js Show response
dev.visualwebsiteoptimizer.com/cdn/edrv/ 18 KB
5 KB 37ms
33ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-61dc49ec658dadeff970ff1e789f1da4br.js
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8b1e99a837f85ce645c80aae729f6009d78c6ae46386b4b0fcf149d167f3ef26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=OuqLZw==, md5=9sJwJdJwW7FryJfWU4IxfA==
etag: "f6c27025d2705bb16bc897d65382317c"
age: 36741
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 5596
date: Mon, 18 Nov 2024 09:20:42 GMT
last-modified: Mon, 18 Nov 2024 08:10:39 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC5M5RrDD0uUBWz2f_CnkNLWpg2oTWzPtxjOoKDDC4vuetSPyEUi8QduEPlsbfWYXlpjkKw
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731917439347272
content-length: 5596
content-language: en
server: UploadServer

GET
H2 200 Forrester-Wave-Featured-Nav2_203x203-1.jpg
redcanary.com/wp-content/uploads/2023/08/ 13 KB
13 KB 242ms
230ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2023/08/Forrester-Wave-Featured-Nav2_203x203-1.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

5a7e4301988674bdfde552e51053fba690337f07233420265674976ee40dabe5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "64d7fa0b-3273"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12915
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/jpeg
last-modified: Sat, 12 Aug 2023 21:30:51 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 product-cta4.jpg
redcanary.com/wp-content/uploads/2024/05/ 105 KB
106 KB 242ms
231ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2024/05/product-cta4.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

7b386ad2debb9b701ec71427b4ec08dce25b898555d9c5d42e6d70bd2bf39fcc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "6651228c-1a587"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 107911
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/jpeg
last-modified: Fri, 24 May 2024 23:28:12 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 Threat-Detection-Square-1157-975x975.jpg
redcanary.com/wp-content/uploads/2017/11/ 46 KB
46 KB 242ms
231ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2017/11/Threat-Detection-Square-1157-975x975.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

2717e27b5a6f8bf09cb6edec5d8ca1d445cecbfd10b416ad2d516f7e568e3694

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "5fa9b54e-b7b7"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 47031
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/jpeg
last-modified: Mon, 09 Nov 2020 21:31:58 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 Tony-500x500.jpg
redcanary.com/wp-content/uploads/2019/06/ 38 KB
38 KB 239ms
229ms Image
image/jpeg 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/uploads/2019/06/Tony-500x500.jpg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

4932426c8682c7d9546d24e9d6b4b2d61168a70baecb158c983ca05b7a67523c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "5fa9b641-9775"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 38773
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/jpeg
last-modified: Mon, 09 Nov 2020 21:36:01 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 red-canary-logo.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 13 KB
13 KB 240ms
232ms Image
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/red-canary-logo.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

fdde1a262315097f4ff5b5ed0a1d2fcdd4b569ff0faa9a82aaeb5e7007781147

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65e68ad2-3404"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 13316
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: image/png
last-modified: Tue, 05 Mar 2024 03:00:34 GMT
server: nginx
vary: Accept-Encoding

POST
H/1.1 200
OK visitWebPage
003-yru-314.mktoresp.com/webevents/ 2 B
318 B 567ms
113ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1731958383355&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1731958383351-81608&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Transfer-Encoding: chunked
X-Request-Id: 396949cb-0a2f-4311-a9fc-85164e205e74
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Origin: *
Date: Mon, 18 Nov 2024 19:33:03 GMT
Content-Type: text/plain; charset=UTF-8
Server: nginx/1.20.1

POST
H2 204 collect
analytics.google.com/g/ 0
0 255ms
100ms Fetch
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835za200&_p=1731958382079&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=1249598163.1731958384&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1731958383&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2514
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
57 B 193ms
67ms Ping
text/plain 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=1249598163.1731958384&gtm=45je4be0v874113835za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067554~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 15E2 0
0 232ms
88ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-T3K4MTNQJN&gacid=1249598163.1731958384&gtm=45je4be0v874113835za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=286747454

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Nov 2024 19:33:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 226ms
99ms Fetch
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835za200&_p=1731958382079&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=1249598163.1731958384&ecid=814496460&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EA&_s=1&sid=1731958383&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2543
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 163ms
66ms Ping
text/plain 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S6W6WXK4G8&cid=1249598163.1731958384&gtm=45je4be0v874113835za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067554~102067808~102077855
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 2DD3 0
0 212ms
87ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-S6W6WXK4G8&gacid=1249598163.1731958384&gtm=45je4be0v874113835za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067554~102067808~102077855&z=2048956187

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Nov 2024 19:33:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Show response
j.6sc.co/j/ 5 KB
2 KB 331ms
118ms Script
application/javascript 23.206.172.17
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.17 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-206-172-17.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
etag: "e32c5c81f0cda4121d7ac50a6fa46548"
x-amz-version-id: ZP_GnDytUL9NRU7xM5CP6PgfirMXR58J
expires: Mon, 18 Nov 2024 20:03:04 GMT
x-amz-cf-id: 8dKh7BsTsF95WR5sjJkZIk9AtH49Qs9kHlzzT2SA8oaOCyOxOvaCrA==
date: Mon, 18 Nov 2024 19:33:04 GMT
last-modified: Thu, 15 Feb 2024 19:15:51 GMT
vary: Accept-Encoding
content-type: application/javascript
x-amz-meta-content-type: application/json
cache-control: private, max-age=1800
accept-ranges: bytes
content-length: 1566
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 287 KB
99 KB 103ms
102ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-759876114&l=dataLayer&cx=c&gtm=45He4be0v813277038za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

309b8f25c10e16acefeb3f95015c319767bbcebe96da39726767ca800e2693aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Mon, 18 Nov 2024 19:33:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 18 Nov 2024 18:32:11 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 100789
x-xss-protection: 0
server: Google Tag Manager

POST
H3 200 collect
www.google.com/ccm/ 0
0 271ms
86ms Ping
text/plain 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1665802172.1731958384&auid=859653460.1731958384&npa=0&gtm=45He4be0v813277038za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&tft=1731958383827&tfd=2583&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s35-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
13 KB 117ms
33ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 1f120dbe60c10831180babf37afc0edb7c01e9f4e7b135cfedc58b3523c887fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: public, max-age=60
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
etag: "5e9ac3a42b557bf8ca38cf2e8baba70b"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 12126
date: Mon, 18 Nov 2024 19:33:03 GMT
last-modified: Tue, 15 Oct 2024 19:34:59 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
server: snooserv
x-amz-server-side-encryption: AES256

GET
H2 200 bat.js Show response
bat.bing.com/ 50 KB
15 KB 184ms
74ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "028e0691d20db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DAAD5579EAAD43A9AB47B3C0B852103F Ref B: MIA301000108039 Ref C: 2024-11-18T19:33:03Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14570
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: application/javascript
last-modified: Wed, 16 Oct 2024 22:47:44 GMT
vary: Accept-Encoding

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 257ms
64ms Script
application/javascript 2600:141b:b000::173b:fbd0
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:b000::173b:fbd0 Newark, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=69297
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Mon, 18 Nov 2024 19:33:04 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 57 KB
16 KB 460ms
63ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

vary: Accept-Encoding,Host
cache-control: no-cache
content-encoding: gzip
etag: "4328e910de583ad53b3a7a76455af005+gzip"
accept-ranges: bytes
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 15926
date: Mon, 18 Nov 2024 19:33:04 GMT
x-tw-cdn: FT
last-modified: Tue, 29 Oct 2024 01:22:31 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-iad-kcgs7200171-IAD
x-amz-server-side-encryption: AES256

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 239 KB
61 KB 176ms
93ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-WWj2Jhwp' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-WWj2Jhwp' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=69, rtx=0, c=23, mss=1232, tbw=4442, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: Wy2f3iFxZLY3vwRqfPlMJwGo0hLOx4YnjTJPH+7rYSgpQqyCOtUiqPHyG2/vfNTihzscVYY8OFqR6SH/x1wcmQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 62152
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2

200

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=redcanary.com&pId=7184709002420862473

4 B
281 B

380ms
181ms

Image
application/json

2600:9000:23ca:d400:5:7a81:86c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=redcanary.com&pId=7184709002420862473
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H2
Server: 2600:9000:23ca:d400:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

via: 1.1 b601959712c1f21193a489b5759f70ba.cloudfront.net (CloudFront)
apigw-requestid: BdRxsi3zIAMEVNg=
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 4
x-amz-cf-id: V6gIeEggRBY9dCwIGGPXWkp-RBEhg5HGUlAHoaR_KTfJyJnkYaga1w==
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P2

Redirect headers

cache-control: no-store, no-cache, private
location: https://attr.ml-api.io/?domain=redcanary.com&pId=7184709002420862473
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.74; 38.132.118.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: acee9caa-5880-468e-adfd-5e409559a943
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 18 Nov 2024 19:33:04 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 204 collect
analytics.google.com/g/ 0
0 86ms
85ms Fetch
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835z8813277038za200&_p=1731958382079&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=1249598163.1731958384&ecid=814496460&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EAAC&_s=2&sid=1731958383&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&en=page_view&_et=142&tfd=2695
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 XDFrame Show response
resource.redcanary.com/index.php/form/ Frame F57F 2 KB
901 B 133ms
115ms Document
text/html 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/index.php/form/XDFrame

Requested by

Host: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: max-age=3600
cf-cache-status: DYNAMIC
cf-ray: 8e4a63dc2816a51b-MIA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 18 Nov 2024 19:33:04 GMT
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

POST
H2 200 admin-ajax.php Show response
redcanary.com/wp-admin/ 0
665 B 809ms
807ms XHR
text/html 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-admin/admin-ajax.php

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-robots-tag: noindex
content-encoding: br
x-permitted-cross-domain-policies: master-only
x-content-type-options: nosniff, nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: text/html; charset=UTF-8
feature-policy: microphone 'none'; geolocation 'none'
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN, deny
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: no-cache, must-revalidate, max-age=0, no-store
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1; mode=block
x-powered-by: WP Engine
server: nginx

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
624 B 65ms
58ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: pcXWFGpuVeSg/jVnYCseRg==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 23006
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/svg+xml
last-modified: Mon, 18 Nov 2024 02:24:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: e6360be9-701e-00cf-39a5-39f438000000
cf-ray: 8e4a63dc3f862209-MIA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
518 B 46ms
45ms Fetch
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: tXyZydHjxQshFMbbBT1/8A==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 12234
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/svg+xml
last-modified: Mon, 18 Nov 2024 02:24:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 096e2f07-501e-00f1-127c-394219000000
cf-ray: 8e4a63dc4e7d6c87-MIA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 ot_company_logo.png
cdn.cookielaw.org/logos/static/ 4 KB
4 KB 47ms
46ms Image
image/png 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_company_logo.png

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: E8+sk/ECzKgTUVtDLikiIA==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
etag: 0x8DD04E9B945DA9C
age: 44382
cf-cache-status: HIT
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/png
last-modified: Thu, 14 Nov 2024 20:20:03 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 590207a8-101e-003a-1f91-37d029000000
cf-ray: 8e4a63dc6fc12209-MIA
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4036
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 63ms
63ms Image
image/svg+xml 2606:4700::6812:572a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-md5: Y+c301RBZNK39PvKQWrIBw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
cf-cache-status: HIT
age: 45689
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/svg+xml
last-modified: Thu, 14 Nov 2024 20:20:04 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=86400
cross-origin-resource-policy: cross-origin
x-ms-request-id: 73a8f2e6-f01e-003b-5eea-36d1d4000000
cf-ray: 8e4a63dc6fc22209-MIA
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 u
cdn.bizible.com/ 43 B
108 B 40ms
33ms Image
image/gif 152.199.2.76
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.bizible.com/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1731958383351-81608&_biz_u=d20d8f441ccb4a19e6178566175c5d94&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&_biz_t=1731958384075&_biz_i=Lateral%20Movement%20Using%20WinRM%20and%20WMI&_biz_n=1&a=redcanary.com&rnd=352046&cdn_o=a&_biz_z=1731958384079

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.2.76 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mid/877B) /

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSub

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSub
cache-control: no-cache, no-store
pragma: no-cache
age: 18528
expires: -1
accept-ranges: bytes
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: Image/GIF
last-modified: Mon, 18 Nov 2024 14:24:16 GMT
server: ECS (mid/877B)

GET
H2 200 sw_iframe.html
www.googletagmanager.com/static/service_worker/4al0/ Frame F6FE 0
0 217ms
72ms Document
text/html 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fredcanary.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 343522
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1476
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/analytics-container-tag-serving
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 14 Nov 2024 20:07:42 GMT
expires: Fri, 14 Nov 2025 20:07:42 GMT
last-modified: Mon, 21 Oct 2024 16:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 admin-ajax.php Show response
redcanary.com/wp-admin/ 0
665 B 847ms
845ms XHR
text/html 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-admin/admin-ajax.php

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, deny
X-Xss-Protection	1; mode=block

Request headers

Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-robots-tag: noindex
content-encoding: br
x-permitted-cross-domain-policies: master-only
x-content-type-options: nosniff, nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: text/html; charset=UTF-8
feature-policy: microphone 'none'; geolocation 'none'
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN, deny
strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: no-cache, must-revalidate, max-age=0, no-store
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin
access-control-allow-origin: https://redcanary.com
x-xss-protection: 1; mode=block
x-powered-by: WP Engine
server: nginx

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/t2_5kac730w/ 3 B
124 B 160ms
66ms XHR
application/json 151.101.193.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/t2_5kac730w/config
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=14400
content-encoding: gzip
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/json

GET
H2 200 t2_5kac730w_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
700 B 112ms
45ms XHR
application/json 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_5kac730w_telemetry
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=300
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 98
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/json
vary: Accept-Encoding,Origin
server: snooserv

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 155ms
66ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1731958384178&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=d2e1dfb9-56d7-4efc-be89-fb8ecdff53a9&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_49267bce&dpm=&dpcc=&dprc=
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after: 0
cross-origin-resource-policy: cross-origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
content-length: 42
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif
server: Varnish

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/ 43 B
62 B 231ms
86ms Script
text/javascript 142.250.65.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1731958384209&cv=11&fst=1731958384209&bg=ffffff&guid=ON&async=1&gtm=45be4be0v9103488584z8813277038za201zb813277038&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&hn=www.googleadservices.com&frm=0&tiba=Lateral%20Movement%20Using%20WinRM%20and%20WMI&npa=0&pscdl=noapi&auid=859653460.1731958384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-759876114&l=dataLayer&cx=c&gtm=45He4be0v813277038za200

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 37
date: Mon, 18 Nov 2024 19:33:04 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 759876114
td.doubleclick.net/td/rul/ Frame 1DAF 0
0 104ms
101ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/759876114?random=1731958384209&cv=11&fst=1731958384209&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4be0v9103488584z8813277038za201zb813277038&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&hn=www.googleadservices.com&frm=0&tiba=Lateral%20Movement%20Using%20WinRM%20and%20WMI&npa=0&pscdl=noapi&auid=859653460.1731958384&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-759876114&l=dataLayer&cx=c&gtm=45He4be0v813277038za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 1534
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 18 Nov 2024 19:33:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 forms2.min.js Show response
resource.redcanary.com/js/forms2/js/ Frame F57F 199 KB
0 2ms
2ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://resource.redcanary.com/js/forms2/js/forms2.min.js

Requested by

Host: resource.redcanary.com
URL: https://resource.redcanary.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://resource.redcanary.com/index.php/form/XDFrame

Response headers

cache-control: public, max-age=14400
content-encoding: gzip
cf-cache-status: HIT
etag: "2d803a3-31b73-6265f6525d19f"
age: 2737
x-content-type-options: nosniff
cf-ray: 8e4a63ceea97a51b-MIA
expires: Mon, 18 Nov 2024 23:33:01 GMT
date: Mon, 18 Nov 2024 19:33:01 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Fri, 08 Nov 2024 04:43:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 1042590016249604 Show response
connect.facebook.net/signals/config/ 69 KB
14 KB 78ms
77ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1042590016249604?v=2.9.177&r=stable&domain=redcanary.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

fdce2458920389b1226f60ed6be7ddb5e68b6742add7dbd1bda6ea50e3a48dc0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'nonce-ipyXyKVD' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'nonce-ipyXyKVD' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=70, rtx=0, c=77, mss=1232, tbw=70936, tp=67, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: MXXne+bC+q/oovL/wfH8wPMT9YnmOQilsL8SK6wmc+CyTsyJJbZ5x00/itQagpCO3ZbxOtjZ4QCFKFtpnD7FMg==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 14122
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
563 B 179ms
100ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: BFD2FFBB851B4214AC882924BEFE04F2 Ref B: MIAEDGE2921 Ref C: 2024-11-18T19:33:04Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYnNPxFavv34nFSqgyORQ==
x-li-proto: http/2
access-control-allow-origin: https://redcanary.com
x-cache: CONFIG_NOCACHE
date: Mon, 18 Nov 2024 19:33:04 GMT
vary: Origin

GET
H3 200 css
fonts.googleapis.com/ 8 KB
794 B 225ms
87ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 18 Nov 2024 19:33:04 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET forms2.css
resource.redcanary.com/js/forms2/css/ 0
0

GET forms2-theme-plain.css
resource.redcanary.com/js/forms2/css/ 0
0

GET
H2 200 messenger
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 5AD4 0
0 320ms
221ms Document
text/html 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=91790cc4-6d49-49e6-a8e0-b2614bbef4d9

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://redcanary.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8e4a63df7bf55c69-MIA
content-encoding: gzip
content-security-policy
content-type: text/html; charset=utf-8
date: Mon, 18 Nov 2024 19:33:04 GMT
link: <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
x-cache: miss
x-content-type-options: nosniff
x-download-options: noopen
x-envoy-upstream-service-time: 37
x-permitted-cross-domain-policies: none
x-request-id: 06d232a0-25c7-45c4-8d95-a8736adeb787
x-runtime: 0.035712
x-xss-protection: 1; mode=block

GET
H2 200 56383426.js Show response
bat.bing.com/p/action/ 363 B
433 B 61ms
60ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/56383426.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B52C6973FE7D4D47B5B96D3EE62CDF08 Ref B: MIA301000108039 Ref C: 2024-11-18T19:33:04Z
x-cache: CONFIG_NOCACHE
date: Mon, 18 Nov 2024 19:33:03 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 6si.min.js Show response
j.6sc.co/ 68 KB
19 KB 84ms
83ms Script
application/javascript 23.206.172.17
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.172.17 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-206-172-17.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, proxy-revalidate, max-age=10800
content-encoding: gzip
etag: "66fb91ae-111bb"
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 22:33:04 GMT
accept-ranges: bytes
content-length: 18819
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/javascript
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
last-modified: Tue, 01 Oct 2024 06:07:42 GMT

GET
H3 200 track-26c93666cadd42d35a525458cedd33edbr.js Show response
dev.visualwebsiteoptimizer.com/cdn/7.0/ 17 KB
5 KB 49ms
48ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/7.0/track-26c93666cadd42d35a525458cedd33edbr.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 18ee167e628f3d1637fc06e5fa234d5eb464088a3f233a679859ec23c21e179a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=96Q88g==, md5=yd7Se2BKGY2G8QE6t1jSTA==
etag: "c9ded27b604a198d86f1013ab758d24c"
age: 34848
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 4842
date: Mon, 18 Nov 2024 09:52:16 GMT
last-modified: Mon, 18 Nov 2024 08:38:09 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC4mSkKNmJb_mlohXsDKhRma3v79FLK2HAKiffYFWTTFhtr85wILZR6WKX61G5gWcp4bD9PFMcR3qA
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731919089501557
content-length: 4842
content-language: en
server: UploadServer

GET
H3 200 opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Show response
dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/ 157 KB
40 KB 37ms
36ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 32f40b8bc8e2ca8b2a2822d6378716b9b130575afe39b51e764bcaa5d357575a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=Md5CSQ==, md5=BY3q3XFcoJRgei/SQSwWMA==
etag: "058deadd715ca094607a2fd2412c1630"
age: 11754
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 40448
date: Mon, 18 Nov 2024 16:17:10 GMT
last-modified: Mon, 18 Nov 2024 15:33:22 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AFiumC6X02KdpmcZLjixbphgEyQRn65l4ylC8TgalAoQYRdg7RnHl99Mc_mFCuq8AWsKEkmt7zFwD03IOQ
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1731944002067936
content-length: 40448
content-language: en
server: UploadServer

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
764 B 209ms
131ms XHR
application/json 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=1540753&time=1731958384529&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Accept: *
Referer: https://redcanary.com/

Response headers

x-li-pop: afd-prod-lor1-x
content-encoding: gzip
x-fs-uuid: 00062734fc489d26f97686a77864a347
x-msedge-ref: Ref A: D3BF8C6039D24AD9B0DD829996B61A88 Ref B: MIA301000105021 Ref C: 2024-11-18T19:33:04Z
x-li-fabric: prod-lor1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYnNPxInSb5doaneGSjRw==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movem...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movem...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1731958384529%26li_adsId%3Dbd16d179-0879-436f-ad10-172beba7d2d0%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movem...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-move...

0
488 B

165ms
85ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKBCWFNeK8lXQAAAZNAw6jJj0NIib7gxV-pYXjkeOfTFfYWqfMVLFORl363t6I7VcAnAQ
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 4B21E52D3BD94A08948531E85E9155B1 Ref B: MIAEDGE1816 Ref C: 2024-11-18T19:33:04Z
x-li-fabric: prod-lva1
x-li-uuid: AAYnNPxNp8YtDkZB0QRihA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731958384529&li_adsId=bd16d179-0879-436f-ad10-172beba7d2d0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tm=gtmv2&cookiesTest=true&liSync=true&e_ipv6=AQKBCWFNeK8lXQAAAZNAw6jJj0NIib7gxV-pYXjkeOfTFfYWqfMVLFORl363t6I7VcAnAQ
x-msedge-ref: Ref A: D1D3C7CE52D44E8BA39EE55935149B7F Ref B: MIAEDGE2921 Ref C: 2024-11-18T19:33:04Z
x-li-fabric: prod-lva1
x-li-uuid: AAYnNPxLJDoOVFt2yL7DsA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Mon, 18 Nov 2024 19:33:04 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
632 B 294ms
169ms Image
image/gif 162.159.140.229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=408cf5ae-7e44-4981-bcab-2741dbaa0e56&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=2de075e0-8acb-44fa-9e08-186920a17784&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=0
x-transaction-id: c9de8fca1d53c4fc
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 77d9844926b8acb061e76f5fdba330751c8d5f510f4045f1559d6f53bb0f839a
cf-cache-status: DYNAMIC
cf-ray: 8e4a63e06fa3a51e-MIA
x-response-time: 84
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif;charset=utf-8
perf: 7402827104
server: cloudflare tsa_b

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
724 B 244ms
121ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=408cf5ae-7e44-4981-bcab-2741dbaa0e56&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=2de075e0-8acb-44fa-9e08-186920a17784&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=631138519
x-transaction-id: bd72dfa843e83afe
cache-control: no-cache, no-store, max-age=0
x-connection-hash: a416ba690ed244a0f07e4ab10662c084a271fa19a3ea2b2cb57bcb4f2ef375cd
x-response-time: 76
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
perf: 7402827104
content-type: image/gif;charset=utf-8
server: tsa_b

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 165ms
68ms Image
text/plain 31.13.80.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&rl=&if=false&ts=1731958384586&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731958384581.126016300741108598&ler=empty&cdl=API_unavailable&it=1731958384329&coo=false&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=84, rtx=0, c=23, mss=1232, tbw=4489, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
195 B 277ms
181ms Image
image/png 31.13.80.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&rl=&if=false&ts=1731958384586&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=4126&fbp=fb.1.1731958384581.126016300741108598&ler=empty&cdl=API_unavailable&it=1731958384329&coo=false&rqm=FGET

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7438704618585061543"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: vwf1DGHM0jxEVRuH+pDdpqp9NAQMEgImX+9qAPVO7QnLKvZq2fhtS7WE216vqpzMlmaScCAOrNMRztVQTX9pHA==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7438704618585061543", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=78, rtx=0, c=23, mss=1232, tbw=4809, tp=12, tpl=0, uplat=97, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 204 0
bat.bing.com/action/ 0
362 B 69ms
68ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=421fdf29-a91f-4a63-a489-3ebb0d192303&bo=1&sid=ee4eb430a5e311ef8bd3d3b5b94c7fb3&vid=ee4ec6f0a5e311efbca25966c641c49c&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Lateral%20Movement%20Using%20WinRM%20and%20WMI&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&r=&lt=1568&evt=pageLoad&sv=1&cdb=AQET&rn=373419

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D874F20D69EA48B0B39AE38B4D658F88 Ref B: MIA301000108039 Ref C: 2024-11-18T19:33:04Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 18 Nov 2024 19:33:03 GMT

POST
H3 200 s.gif
dev.visualwebsiteoptimizer.com/ 35 B
53 B 65ms
64ms Ping
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=D4384814343C335266B5080058EE981ED&s=1731958382&p=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1731958384623&v=d1d41ec36&_cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&random=0.08282511141684479

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv02c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
via: 1.1 google
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif
server: gnv02c

GET
H3 200 worker-70faafffa0475802f5ee03ca5ff74179br.js Show response
dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/ 46 KB
13 KB 45ms
43ms XHR
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/worker-70faafffa0475802f5ee03ca5ff74179br.js
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

x-goog-metageneration: 1
content-encoding: br
x-goog-hash: crc32c=t9nekA==, md5=OTBW++nqbotSERjfhuer5A==
etag: "393056fbe9ea6e8b521118df86e7abe4"
age: 2352781
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 13401
date: Tue, 22 Oct 2024 14:00:03 GMT
last-modified: Fri, 18 Oct 2024 10:52:37 GMT
content-type: text/javascript; charset=UTF-8
x-guploader-uploadid: AHmUCY3Tb6U94Ir8qPEtmOnl6QlPmw7PCsDDsjYoE90CtZ8w5UoavbEIAelE6LFqBaLVAugZDVg
cdn_cache_status: hit
cache-control: public, max-age=31536000
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1724420808757657
content-length: 13401
content-language: en
server: UploadServer

GET
H2 200 getuidj Show response
secure.adnxs.com/ 29 B
1 KB 110ms
107ms XHR
application/json 68.67.179.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

96377c6f68c4e1c2006434c9405b71257c2ec5a692191333c427d7f4513812d8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 38.132.118.74; 38.132.118.74; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://redcanary.com
an-x-request-uuid: 85534a67-0b18-4c63-96ac-4fa85947e5c3
content-length: 29
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 18 Nov 2024 19:33:04 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H/1.1 200
OK / Show response
c.6sc.co/ 7 B
327 B 588ms
66ms XHR
text/html 23.206.172.12
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.12 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-206-172-12.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

Access-Control-Max-Age: 86400
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: https://redcanary.com
Content-Length: 7
Date: Mon, 18 Nov 2024 19:33:05 GMT
Content-Type: text/html
Access-Control-Allow-Headers: *

GET
H2 200 / Show response
ipv6.6sc.co/ 18 B
307 B 272ms
87ms XHR
text/html 2600:141b:1c00:2e::17d1:48d1
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:2e::17d1:48d1 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 6b53dae8104f6cb0502751557f3e1eb3dc74ebb2fc239068ec830daabeb834ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
pragma: no-cache
6si-ipv6: 2001:550:1d05:1::4
expires: Mon, 18 Nov 2024 19:33:04 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1731958384803_399550033_4049474503_15_565_64_70_219";dur=1
access-control-allow-origin: https://redcanary.com
content-length: 18
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: text/html
vary: Origin

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 248ms
83ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:04 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 246ms
82ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22e8bebcdaa132f727ae8d16d9967447769318945e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22f3744a5e-342b-429c-9d2c-2c1b7b45310a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:04 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 details Show response
eps.6sc.co/v3/company/ 752 B
657 B 264ms
159ms XHR
application/json 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash: 55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39

Request headers

Authorization: Token e8bebcdaa132f727ae8d16d9967447769318945e
X-6s-CustomID: WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a
Referer: https://redcanary.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: X-6si-Region
timing-allow-origin: https://6sense.com
content-encoding: gzip
x-6si-region
access-control-allow-credentials: true
access-control-allow-origin: https://redcanary.com
content-length: 400
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: application/json
vary: Origin, Accept-Encoding

OPTIONS
H2 200 details
eps.6sc.co/v3/company/ Frame 0
0 178ms
62ms Preflight 75.2.108.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eps.6sc.co/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 75.2.108.141 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afe865822f884bb48.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://redcanary.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://redcanary.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
content-length: 0
date: Mon, 18 Nov 2024 19:33:04 GMT
timing-allow-origin: https://6sense.com
x-6si-region

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 76ms
75ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:04 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:04 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 200ms
66ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
age: 1095
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 21:14:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:14:50 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 92ms
91ms Fetch
text/plain 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835z8813277038za200&_p=1731958382079&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=1249598163.1731958384&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EAAC&_s=2&sid=1731958383&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&en=page_view&_et=141&tfd=4052
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: text/plain
server: Golfe2

GET 857bf86b-a4b5-4478-b1bd-6face4b1c9c0
https://redcanary.com/ Frame 0
0

POST
H2 200 analyze Show response
r4.visualwebsiteoptimizer.com/ 0
143 B 435ms
160ms XHR
application/javascript 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://r4.visualwebsiteoptimizer.com/analyze?_a=906194&_u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 140.201.145.34.bc.googleusercontent.com
Software: r4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAX98L9SU6MBsYlKH
Referer: https://redcanary.com/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: application/javascript; charset=UTF-8
server: r4

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
357 B 84ms
82ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=583205838&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&ul=en-us&de=UTF-8&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=1323534436&gjid=2071572782&cid=1249598163.1731958384&tid=UA-52702906-1&_gid=1379520032.1731958386&_r=1&_slc=1&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&z=1681297244

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://redcanary.com/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:05 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
407 B 67ms
66ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=583205838&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&ul=en-us&de=UTF-8&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=1249598163.1731958384&tid=UA-52702906-1&_gid=1379520032.1731958386&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067554~102067808~102077855&cd6=United%20States&cd7=Florida&cd8=Miami&cd9=&cd12=&cd13=&cd14=&cd18=null&z=1346852262

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

age: 13880
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 15:41:45 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/dcdn/ 23 KB
6 KB 63ms
62ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=906194&settings_type=4&ts=1731946629&dt=desktop&cc=US
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gsc1 /
Resource Hash: 59f98fc08005267c4daef422ae2c56f4a3bf71232b5795179ff5f5f1f14344b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cdn_cache_status: revalidated
cache-control: public, max-age=1800, s-maxage=1800
content-encoding: gzip
etag: W/"1731946629_EA"
age: 0
via: 1.1 google
not-modified: true
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5779
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: application/javascript; charset=UTF-8
server: gsc1

GET
H2 200 favicon.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 16 KB
16 KB 77ms
75ms Other
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "5c76b1ec-3fb8"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16312
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/png
last-modified: Wed, 27 Feb 2019 15:51:08 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 77ms
76ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A04%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%221006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:05 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 favicon.ico
redcanary.com/wp-content/themes/redcanary/assets/img/ 1 KB
812 B 76ms
74ms Other
image/x-icon 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
content-encoding: br
etag: W/"65e68ad0-47e"
access-control-allow-origin: *
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/x-icon
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
server: nginx
last-modified: Tue, 05 Mar 2024 03:00:32 GMT

GET
H2 200 favicon-32x32.png
redcanary.com/wp-content/themes/redcanary/assets/img/ 1 KB
2 KB 80ms
79ms Other
image/png 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon-32x32.png

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65e68ad0-5c9"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1481
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/png
last-modified: Tue, 05 Mar 2024 03:00:32 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
257 B 177ms
59ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.12593802529800535&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520477%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%25201999%2520477%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
256 B 182ms
64ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.2906595031064314&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520276%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520500%2520276%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=3

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
256 B 181ms
63ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.3911033935341881&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520631%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%25201999%2520631%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
256 B 180ms
63ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.11698725238423502&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520396%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520750%2520396%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
256 B 179ms
62ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.9752580524782781&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%22%2520775%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%25201999%2520775%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 analyze
r4.visualwebsiteoptimizer.com/ 35 B
256 B 177ms
60ms Image
image/gif 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://r4.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&duration=0&session_id=1731958382&recording_id=1&vn=4.0.340&rand=0.09979808229454457&end_time=1731958383903&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%220%252052%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520210%252052%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731958385903&fRS=true&re=%7B%222%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&he=%7B%221%22%3A%22D4384814343C335266B5080058EE981ED%22%7D&v2=true&count=7

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

140.201.145.34.bc.googleusercontent.com

Software

r4 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 10 Jan 2005 00:00:01 GMT
access-control-allow-origin: *
content-length: 35
date: Mon, 18 Nov 2024 19:33:05 GMT
content-type: image/gif
server: r4

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 74ms
73ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "60bb2e15-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:06 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:06 GMT
content-type: image/gif
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 80ms
80ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A06%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:07 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:07 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 76ms
76ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A07%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:08 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:08 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 91ms
90ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A08%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "615ccf10-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:09 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:09 GMT
content-type: image/gif
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H3 204 collect
analytics.google.com/g/ 0
0 83ms
82ms Fetch
text/plain 142.250.65.238

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835z8813277038za200&_p=1731958382079&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067554~102067808~102077855&cid=1249598163.1731958384&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EA&_s=3&sid=1731958383&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&dt=Lateral%20Movement%20Using%20WinRM%20and%20WMI&en=company_details_6si&_et=1358&up.company_name_6si=(Non-company%20Visit)&up.country_6si=United%20States&up.state_6si=Florida&up.city_6si=Miami&up.industry_v2_6si=&up.segment_666498_6si=false&up.segment_673397_6si=false&tfd=9053
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.238 -, , ASN (),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://redcanary.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:10 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 t
dev.visualwebsiteoptimizer.com/events/ 0
36 B 64ms
62ms Ping
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_errorOnPage&a=906194&v=d1d41ec36&_cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv02c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://redcanary.com/

Response headers

content-encoding: gzip
access-control-allow-methods: GET, POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 19:33:09 GMT
content-type: application/javascript; charset=UTF-8
server: gnv02c
access-control-allow-headers: X-Device-User-Agent, Vwo-X-Forwarded-For

GET
H2 200 98d95a423523306377f329f65410715dcbec610d14f2704afe66fce2c32247b9.png
customer-assets.qualified.com/cdn-cgi/image/trim.left=0,trim.top=0,trim.width=1000,trim.height=1000/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/ 409 KB
410 KB 329ms
325ms Image
image/png 104.18.17.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://customer-assets.qualified.com/cdn-cgi/image/trim.left=0,trim.top=0,trim.width=1000,trim.height=1000/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/98d95a423523306377f329f65410715dcbec610d14f2704afe66fce2c32247b9.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7e8172af5137c21d52d9c84f62af871d691538ffb44348bba54e43502aebb6c7

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cf-cache-status: HIT
etag: "cfwz85l6NqsIMaZMm_SN95lolJW9ZcwGWLRAQEkXgADQ:ecc2f2e45c425530c12e247c1eba9378"
cf-bgj: imgq:0,h2pri
cf-resized: internal=ok/h q=0 n=30+5 c=4+1 v=2024.10.6 l=418627 f=false
x-content-type-options: nosniff
date: Mon, 18 Nov 2024 19:33:10 GMT
content-type: image/png
last-modified: Mon, 18 Nov 2024 15:18:23 GMT
vary: Accept, Accept-Encoding
priority: u=4;i=?0,cf-chb=(58;u=5;i)
content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: Cache-Control: public, max-age=31536000
cf-ray: 8e4a64045f917455-MIA
accept-ranges: bytes
content-length: 418627
server: cloudflare

GET
H2 200 CanarySans-Text-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/ 23 KB
23 KB 149ms
148ms Font
font/woff2 104.198.136.223
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-600.woff2

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx /

Resource Hash

62d02c88b4232d936a5d2554226d043540fe3f4b4822aba7f82eb4c72c7eda51

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://redcanary.com
Referer: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css

Response headers

strict-transport-security: "max-age=63072000; includeSubDomains; preload";
content-security-policy: upgrade-insecure-requests
cache-control: public, max-age=31536000
etag: "65f06305-5af4"
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23284
date: Mon, 18 Nov 2024 19:33:10 GMT
content-type: font/woff2
last-modified: Tue, 12 Mar 2024 14:13:25 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 73ms
72ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A09%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:10 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:10 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

POST
H2 200 analyze Show response
r4.visualwebsiteoptimizer.com/ 0
142 B 65ms
61ms XHR
application/javascript 34.145.201.140
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://r4.visualwebsiteoptimizer.com/analyze?_a=906194&_u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.145.201.140 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 140.201.145.34.bc.googleusercontent.com
Software: r4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXfw2SbcKc1dtLDyj
Referer: https://redcanary.com/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Mon, 18 Nov 2024 19:33:11 GMT
content-type: application/javascript; charset=UTF-8
server: r4

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 88ms
87ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A10%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%227010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f020a0-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:11 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:11 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 100ms
100ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A11%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%228010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "5e502810-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:12 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:12 GMT
content-type: image/gif
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 222ms
222ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A12%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%229011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:13 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:13 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 218ms
217ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%2210012%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:14 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:14 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 78ms
77ms Image
image/gif 23.33.42.88
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69&session=22cd9840-e172-413b-8e62-74fc84a81c4b&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2018%20Nov%202024%2019%3A33%3A14%20GMT%22%2C%22timeSpent%22%3A%223000%22%2C%22totalTimeSpent%22%3A%2213012%22%7D&isIframe=false&m=%7B%22description%22%3A%22Attackers%20frequently%20move%20laterally%20with%20tools%20included%20in%20Windows.%20Go%20behind%20the%20scenes%20of%20an%20attack%20using%20WinRM%20and%20WMI.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Lateral%20Movement%20Using%20WinRM%20and%20WMI%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&pageViewId=bbcd667f-0534-4da4-8f47-b96375516445&an_uid=7184709002420862473&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A550%3A1d05%3A1%3A%3A4&v=1.1.29

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.42.88 Piscataway, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),

Reverse DNS

a23-33-42-88.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://redcanary.com/

Response headers

cache-control: max-age=0, no-cache, no-store
etag: "63f02dad-2b"
pragma: no-cache
x-content-type-options: nosniff
expires: Mon, 18 Nov 2024 19:33:17 GMT
accept-ranges: bytes
content-length: 43
date: Mon, 18 Nov 2024 19:33:17 GMT
content-type: image/gif
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: redcanary.com
URL: blob:https://redcanary.com/c628ce48-e7bd-4803-a00a-cf2e4890964f

Domain: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/css/forms2.css

Domain: resource.redcanary.com
URL: https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css

Domain: redcanary.com
URL: blob:https://redcanary.com/857bf86b-a4b5-4478-b1bd-6face4b1c9c0

Verdicts & Comments Add Verdict or Comment

124 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

53 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.resource.redcanary.com/	1970-01-21 01:06:00	Name: __cf_bm Value: o6kps00kcvVJUyDgAwy3IY4N1oeRqxR9ROF1oLOcv7g-1731958381-1.0.1.1-R845Cs6L.xT_Qq1tFVLqrFsH3m0P9IL_9ssX1IrhL0bVKqIcasbBImO0vyPDyS5k4VW7R.4sgRqU1IAJ9qdZ7A
.redcanary.com/	1970-01-21 09:51:34	Name: _biz_uid Value: d20d8f441ccb4a19e6178566175c5d94
.redcanary.com/	1970-01-21 09:53:00	Name: _vwo_uuid_v2 Value: D4384814343C335266B5080058EE981ED\|3d9e170e12143f68f0e9ef5249cfc887
.g2crowd.com/	1970-01-21 01:06:00	Name: __cf_bm Value: 3DFk3hLemRJN7xHBKvCJaI7k77lVWU_2oBwbKKzbtDY-1731958382-1.0.1.1-9ll6K1AiZ9.CqhiQcP7kwP4WYke1ITLjF4F5CLv5BGcUOE0RiZhmgoCNvqSHQ0vISJAREUp8xwMD_VwA3S01YA
redcanary.com/	1970-01-21 01:06:19	Name: utm_source Value: redcanary.com
redcanary.com/	1970-01-21 01:06:19	Name: utm_medium Value: direct
redcanary.com/	1970-01-21 01:06:19	Name: utm_campaign Value: Not-Provided
redcanary.com/	1970-01-21 01:06:19	Name: utm_session_set Value: true
.redcanary.com/	1970-01-21 10:41:58	Name: __q_state_bAEbi2aHVysBKzuy Value: eyJ1dWlkIjoiOTE3OTBjYzQtNmQ0OS00OWU2LWE4ZTAtYjI2MTRiYmVmNGQ5IiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSJ9
.bizible.com/	1970-01-21 09:51:34	Name: _BUID Value: d20d8f441ccb4a19e6178566175c5d94
.bizibly.com/	1970-01-21 09:51:34	Name: _BUID Value: afeabbd3f56d64e40e5a49e162929041
.redcanary.com/	1970-01-21 09:51:55	Name: _vwo_uuid Value: D4384814343C335266B5080058EE981ED
.redcanary.com/	1970-01-21 10:41:58	Name: _mkto_trk Value: id:003-YRU-314&token:_mch-redcanary.com-1731958383351-81608
.redcanary.com/	1970-01-21 03:15:34	Name: _gcl_au Value: 1.1.859653460.1731958384
.redcanary.com/	1970-01-21 10:41:58	Name: _ga_S6W6WXK4G8 Value: GS1.1.1731958383.1.1.1731958383.60.0.814496460
.redcanary.com/	1970-01-21 09:51:34	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+Nov+18+2024+09%3A33%3A04+GMT-1000+(Hawaii-Aleutian+Standard+Time)&version=202409.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-detection%2Flateral-movement-winrm-wmi%2F&groups=C0001%3A1%2CC0004%3A1%2CC0002%3A1%2CC0005%3A1%2CC0003%3A1
.redcanary.com/	1970-01-21 09:51:34	Name: _biz_nA Value: 2
.redcanary.com/	1970-01-21 09:51:34	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22Mkto%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
resource.redcanary.com/	1969-12-31 23:59:59	Name: BIGipServersj28web-nginx-app_https Value: !ivpQNFpr+FhtHj2u/iht9W3PGpXZch5uVWWhdSiNJnH9GhciXoNU/QXX/pS/+7n+kk0Fr7+wzs73SA==
.redcanary.com/	1970-01-21 03:29:58	Name: _vis_opt_s Value: 1%7C
.redcanary.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.redcanary.com/	1970-01-21 03:15:34	Name: _rdt_uuid Value: 1731958384170.d2e1dfb9-56d7-4efc-be89-fb8ecdff53a9
.redcanary.com/	1970-01-21 09:51:34	Name: _biz_pendingA Value: %5B%5D
.doubleclick.net/	1970-01-21 10:41:58	Name: IDE Value: AHWqTUkrEHqnCZtn0HeE-aY9H3e7NLYa6s353LXc2lzmITV7LKmZoddX_-fs4eVA
.adnxs.com/	1970-01-21 03:15:34	Name: XANDR_PANID Value: Frwidm78Su7ET1Q9uZxxOu7gBN945ApnOZ0iSHowgreuxebRj7LVOazQ1Z_ycXTvsIgyyo52m1vqyqfayRtipvLI4zALWuergxoh3aZiTPU.
.adnxs.com/	1970-01-21 10:41:58	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 03:15:34	Name: uuid2 Value: 7184709002420862473
.linkedin.com/	1970-01-21 09:51:34	Name: bcookie Value: "v=2&c7e81936-7e0c-4e20-8d80-903884d6a9ae"
.linkedin.com/	1970-01-21 01:07:24	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=3063:u=1:x=1:i=1731958384:t=1732044784:v=2:sig=AQGWbl7OAmotj1Yab0Zvsj0bTJQVotJH"
.redcanary.com/	1970-01-21 03:15:34	Name: _fbp Value: fb.1.1731958384581.126016300741108598
.linkedin.com/	1970-01-21 03:15:34	Name: li_sugr Value: 2b54c8be-d8ab-43a1-982f-eea177196a16
.redcanary.com/	1970-01-21 01:07:24	Name: _uetsid Value: ee4eb430a5e311ef8bd3d3b5b94c7fb3
.redcanary.com/	1970-01-21 10:27:34	Name: _uetvid Value: ee4ec6f0a5e311efbca25966c641c49c
.bing.com/	1970-01-21 10:27:34	Name: MUID Value: 3698DAE7ACDD614E1B60CFDCADAC60E1
.bat.bing.com/	1970-01-21 01:16:03	Name: MR Value: 0
.linkedin.com/	1970-01-21 01:49:10	Name: UserMatchHistory Value: AQIVKli8lB05QgAAAZNAw6gKXKK2ykZ2evWiHpM2yZ8XKqN5uo8w7KVWEwfx-XqKCnnf68Ve0Glpmg
.linkedin.com/	1970-01-21 01:49:10	Name: AnalyticsSyncHistory Value: AQIXYswDm65pzQAAAZNAw6gKlOmLVIRk7QOs3NRyszjeQC2wJGYcIS85rBV3aTC1CWLmATH9JSu701LShJGKww
.redcanary.com/	1970-01-21 03:15:34	Name: _vwo_ds Value: 3%3At_1%2Ca_1%3A0%241731958382%3A43.3510538%3A%3A%3A2_1%2C1_1%3A2
redcanary.com/	1970-01-21 01:16:03	Name: _an_uid Value: 7184709002420862473
redcanary.com/	1970-01-21 10:41:58	Name: _gd_visitor Value: 18d7ad3d-f6b9-4a6e-815c-8a9cd3321a69
redcanary.com/	1970-01-21 01:06:12	Name: _gd_session Value: 22cd9840-e172-413b-8e62-74fc84a81c4b
.www.linkedin.com/	1970-01-21 09:51:34	Name: bscookie Value: "v=1&202411181933040e85c0a1-5081-4178-878a-624a581bef2dAQH8eqUPpwNErJqNlC-EkPvHab7k4Utf"
.twitter.com/	1970-01-21 10:41:58	Name: guest_id_marketing Value: v1%3A173195838471294732
.twitter.com/	1970-01-21 10:41:58	Name: guest_id_ads Value: v1%3A173195838471294732
.twitter.com/	1970-01-21 10:41:58	Name: personalization_id Value: "v1_umhnERjrn6bp6U4EKS4fzg=="
.twitter.com/	1970-01-21 10:41:58	Name: guest_id Value: v1%3A173195838471294732
.t.co/	1970-01-21 10:41:58	Name: muc_ads Value: c84b8979-7b98-4a2b-b4c8-68568f94b9ea
.t.co/	1970-01-21 01:06:00	Name: __cf_bm Value: XvvFqLYVnpeGlPN_d0ZKOTmnCLtksxb_RYyik1OSYhE-1731958384-1.0.1.1-ykKhZxDOoDawP2TkMqFckeV6HxFNDsW1Wur7syjKwg2sYwUSvSDwFd3G.VjaMJ4.uMUSDj9NgfKBzlbfuRh63w
.redcanary.com/	1970-01-21 01:06:00	Name: _vwo_sn Value: 0%3A1%3Ar4.visualwebsiteoptimizer.com%3A1%3A1%3Areferrer%3D
.redcanary.com/	1970-01-21 10:41:58	Name: _ga_T3K4MTNQJN Value: GS1.1.1731958383.1.1.1731958385.58.0.0
.redcanary.com/	1970-01-21 10:41:58	Name: _ga Value: GA1.2.1249598163.1731958384
.redcanary.com/	1970-01-21 01:07:24	Name: _gid Value: GA1.2.1379520032.1731958386
.redcanary.com/	1970-01-21 01:05:58	Name: _gat_UA-52702906-1 Value: 1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/ Message: Access to CSS stylesheet at 'https://resource.redcanary.com/js/forms2/css/forms2.css' from origin 'https://redcanary.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://resource.redcanary.com/js/forms2/css/forms2.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://redcanary.com/blog/threat-detection/lateral-movement-winrm-wmi/ Message: Access to CSS stylesheet at 'https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css' from origin 'https://redcanary.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	"max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.google.com
analytics.twitter.com
app.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.cookielaw.org
cdnjs.cloudflare.com
connect.facebook.net
customer-assets.qualified.com
dev.visualwebsiteoptimizer.com
eps.6sc.co
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
pixel-config.reddit.com
px.ads.linkedin.com
px4.ads.linkedin.com
r4.visualwebsiteoptimizer.com
redcanary.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
td.doubleclick.net
tracking.g2crowd.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
redcanary.com
resource.redcanary.com
104.17.25.14
104.17.73.206
104.18.16.5
104.18.17.5
104.198.136.223
104.244.42.195
104.71.178.49
13.107.42.14
142.250.65.194
142.250.65.227
142.250.65.238
142.250.80.68
142.251.35.170
146.75.36.157
151.101.1.140
151.101.193.140
152.199.2.76
162.159.140.229
192.28.147.68
2001:4860:4802:34::178
23.206.172.12
23.206.172.17
23.33.42.88
2600:141b:1c00:2e::17d1:48d1
2600:141b:b000::173b:fbd0
2600:9000:23ca:d400:5:7a81:86c0:93a1
2606:4700:4400::6812:2089
2606:4700::6812:1eb0
2606:4700::6812:572a
2607:f8b0:4004:c17::9d
2607:f8b0:4006:80f::2008
2607:f8b0:4006:817::200a
2607:f8b0:4006:81e::200a
2607:f8b0:4006:821::2002
2607:f8b0:4006:824::200e
2620:1ec:21::14
2620:1ec:33:1::10
2a04:4e42::396
31.13.80.12
31.13.80.36
34.145.201.140
34.96.102.137
52.92.208.16
68.67.153.60
68.67.179.87
75.2.108.141
07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845
09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0
0b77cd22751607c04664a5da63f0746bda0181d9ef2da8ba3791dd5227a532d3
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
18b368af8e8679b39c6fbbdde36542f3fc345bc9230a35cd1bd06595c1e73608
18ee167e628f3d1637fc06e5fa234d5eb464088a3f233a679859ec23c21e179a
1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1f120dbe60c10831180babf37afc0edb7c01e9f4e7b135cfedc58b3523c887fb
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2717e27b5a6f8bf09cb6edec5d8ca1d445cecbfd10b416ad2d516f7e568e3694
2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c
309b8f25c10e16acefeb3f95015c319767bbcebe96da39726767ca800e2693aa
32f40b8bc8e2ca8b2a2822d6378716b9b130575afe39b51e764bcaa5d357575a
3a800871b05a2d7c53fbb4159f1a7dbb510691639988a81695a50fb19bd04d92
43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44baa21ce9a58ec4912289526b121545065853d4f939b6b62c048144a9af52da
4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43
4932426c8682c7d9546d24e9d6b4b2d61168a70baecb158c983ca05b7a67523c
4c3bb2affbcd85352be47fb9f5869bbbdbfd911e56a1f0ac3fda267bf83f2029
4c6b1061241d9ba3ebe56f9bed639fe79d332c9719445e64826427efabb0b6a3
4dc938ac1478b3c05be5e7ce8a59481f532743dbaf1641cca4445786f28c500b
4e7669e92e0d052b6940b1c108fe488fc344e33e92615ee396c98573ea7e94c8
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
52562aefbf6c058669afe4e04bdb80eeb12164dbe1f446f28e98b5c308271c92
52ce30c1ca4a370f850fadf51868d1792a6e6a81f9488f67b993cc7d2921d187
55096bdb72819db90b109af46d94fce8e71551e9c7a8464a6dcf930f60bb7f39
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
59f98fc08005267c4daef422ae2c56f4a3bf71232b5795179ff5f5f1f14344b8
5a7e4301988674bdfde552e51053fba690337f07233420265674976ee40dabe5
5accbeb22a5e5fc1b0663d3c1fa19fccf9f589c7aecdba876a11d013ba1deb5d
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
62d02c88b4232d936a5d2554226d043540fe3f4b4822aba7f82eb4c72c7eda51
6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6a2fae6141cd3c337ae20368ec6c6d16bcd1774b42c9cf6ef2b79f4ce7a67710
6b53dae8104f6cb0502751557f3e1eb3dc74ebb2fc239068ec830daabeb834ab
6cdeee2508de3768e7bd7966db999cfcd409ffac4031db8d72d49c9054fea627
6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a
71cfd0bf781e3f393bca283fc9d44777a2036985a4ffe9abedf14909e63a8aef
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
790edac9099268352d0c8a6852772b20026c98cafae6ccd74ed05fd6e61a6954
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
7b386ad2debb9b701ec71427b4ec08dce25b898555d9c5d42e6d70bd2bf39fcc
7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359
7e8172af5137c21d52d9c84f62af871d691538ffb44348bba54e43502aebb6c7
805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8b1e99a837f85ce645c80aae729f6009d78c6ae46386b4b0fcf149d167f3ef26
8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
96377c6f68c4e1c2006434c9405b71257c2ec5a692191333c427d7f4513812d8
98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801
9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42
a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f
a1fbda5caa3550449af82c07cba1d79dc6782cf97f1c21dea18d18a820a4c98f
a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6
a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e
a5cecf81dae3770dfa534b64e6883d1a26be92a8c2c31ad85f1dd21d6987e3f7
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace
ae39f3fb5239a3103de720c324ee42c6f1c50b8ddbfb6cf06dcf89ca482a511c
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b299beb73a789a8d7b52742818aa6ca138181937696f93189bd6051cc6db65f2
b474f45de8cb58c109ac4f0317e9844a524e857dda61dce742b8f535964572cd
be3efb305c8998b5773f331a735243d5112df20d1e6a90d859ee3b65dc77bbc7
c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2
c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8
c8794253f4669bc181f3401651637f6a14f68ea3ffd1bd18a8e46abaac6308ac
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
d508e8d84799586df292dc06e23cf3dedfe8d4f4675230bcec7279cec4c724a8
d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af
d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
df064dd6edad0cdc26f0a3abc83b8d5d5b173a41d6b88d8d242823055da2124d
e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7df14128159d5a2757314dd6cbdf8d5351d9ac300c9cf93919a5e595d34e9cf
fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fdce2458920389b1226f60ed6be7ddb5e68b6742add7dbd1bda6ea50e3a48dc0
fdde1a262315097f4ff5b5ed0a1d2fcdd4b569ff0faa9a82aaeb5e7007781147
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

redcanary.com Open in urlscan Pro 104.198.136.223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

149 Requests

96 %HTTPS

35 %IPv6

32 Domains

47 Subdomains

46 IPs

3 Countries

2854 kBTransfer

17464 kBSize

53 Cookies

10 Outgoing links

Page URL History

Redirected requests

149 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Screenshot
Live screenshot

Full Image

149
Requests

96 %
HTTPS

35 %
IPv6

32
Domains

47
Subdomains

46
IPs

3
Countries

2854 kB
Transfer

17464 kB
Size

53
Cookies

149 HTTP transactions
6 data transactions