www.jaiminton.com Open in urlscan Pro
2606:4700:3031::681b:8041 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.jaiminton.com/cheatsheet/DFIR/
Submission: On October 22 via manual (October 22nd 2020, 12:04:02 am UTC) from US

Summary HTTP 22 Redirects Links 207 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 22 HTTP transactions. The main IP is 2606:4700:3031::681b:8041, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.jaiminton.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 21st 2020. Valid for: a year.

This is the only time www.jaiminton.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
15	2606:4700:303... 2606:4700:3031::681b:8041	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
22	5

15 2606:4700:3031::681b:8041 (United States)

ASN13335 (CLOUDFLARENET, US)

www.jaiminton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	jaiminton.com www.jaiminton.com	998 KB
1	google-analytics.com www.google-analytics.com	18 KB
1	fontawesome.com use.fontawesome.com	453 KB
1	googletagmanager.com www.googletagmanager.com	37 KB
0	buymeacoffee.com Failed cdn.buymeacoffee.com Failed
0	googleapis.com Failed fonts.googleapis.com Failed
22	6

	Domain	Requested by
15	www.jaiminton.com	www.jaiminton.com
1	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	use.fontawesome.com	www.jaiminton.com
1	www.googletagmanager.com	www.jaiminton.com
0	cdn.buymeacoffee.com Failed	www.jaiminton.com
0	fonts.googleapis.com Failed	www.jaiminton.com
22	6

This site contains links to these domains. Also see Links.

Domain
buymeacoff.ee
www.hackthebox.eu
www.openbugbounty.org
twitter.com
www.linkedin.com
github.com
binalyze.com
irec.readthedocs.io
belkasoft.com
www.magnetforensics.com
www.volexity.com
docs.microsoft.com
accessdata.com
www.x-ways.net
www.guidancesoftware.com
guymager.sourceforge.io
www.contextis.com
ericzimmerman.github.io
support.microsoft.com
attack.mitre.org
learn-powershell.net
blog.xpnsec.com
gist.github.com
www.crowdstrike.com
medium.com
www.ired.team
plaso.readthedocs.io
www.cyber.gov.au
adsecurity.org
blog.ropnop.com
www.nirsoft.net
www.edgemanage.emmet-gray.com
www.foxtonforensics.com
support.mozilla.org
regauth.standards.ieee.org
www.wireshark.org
unit42.paloaltonetworks.com
mitmproxy.org
wiki.wireshark.org
devblogs.microsoft.com
powerforensics.readthedocs.io
grr-doc.readthedocs.io
b2dfir.blogspot.com
cert.europa.eu
www.dfrws.org
gitlab.unizar.es
volatility3.readthedocs.io
learn.duffandphelps.com
www.youtube.com
downloads.digitalcorpora.org
www.forensicdots.de
en.wikipedia.org
gchq.github.io
urlscan.io
www.osquery.io
www.velocidex.com
b2xtranslator.sourceforge.net
arsenalrecon.com
www.sleuthkit.org
digital-forensics.sans.org
bytefreaks.net
blog.apnic.net
www.mac4n6.com
forensicswiki.org
docs.google.com
www.objective-see.com
car.mitre.org
redcanary.com
ss64.com
www.dfir.training
blog.commandlinekungfu.com
mikefrobbins.com
blogs.technet.microsoft.com
tools.ietf.org
www.cybereason.com
www.datadigitally.com
www.bsk-consulting.de
www.blackhat.com
social.technet.microsoft.com
www.pdq.com
www.linuxnix.com
blogs.msdn.microsoft.com
az4n6.blogspot.com
www.a12d404.net
www.fireeye.com
www.microsoft.com
www.slideshare.net
dfironthemountain.wordpress.com
malware-traffic-analysis.net
posts.specterops.io
www.trustwave.com
www.facebook.com
www.buymeacoffee.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-05-21` - `2021-05-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.jaiminton.com/cheatsheet/DFIR/
Frame ID: 210EB9C2C4A0160B6E8E6AC763F997B0
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: $Varnish\/([\d.]+)$)?/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

22
Requests

82 %
HTTPS

75 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

1507 kB
Transfer

3105 kB
Size

3
Cookies

207 Outgoing links

These are links going to different origins than the main page.

URL: https://buymeacoff.ee/JaiMinton
Title: *Buy me a coffee*

Search URL Search Domain Scan URL

URL: https://www.hackthebox.eu/profile/10636
Title: Hack The Box

Search URL Search Domain Scan URL

URL: https://www.openbugbounty.org/researchers/JPMinty/
Title: Open Bug Bounty

Search URL Search Domain Scan URL

URL: https://twitter.com/CyberRaiju
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/JaiMinton
Title: LinkedIN

Search URL Search Domain Scan URL

URL: https://github.com/JPMinty
Title: GitHub

Search URL Search Domain Scan URL

URL: https://github.com/ForensicArtifacts/artifacts/tree/master/data
Title: ForensicArtifacts

Search URL Search Domain Scan URL

URL: https://github.com/cloudbase/powershell-yaml
Title: ConvertFrom-Yaml module

Search URL Search Domain Scan URL

URL: https://github.com/jschicht/RawCopy
Title: RawCopy

Search URL Search Domain Scan URL

URL: https://binalyze.com/products/irec
Title: Binalyze IREC Evidence Collector

Search URL Search Domain Scan URL

URL: https://irec.readthedocs.io/en/latest/commandline.html
Title: Latest documentation

Search URL Search Domain Scan URL

URL: https://belkasoft.com/get?product=ram
Title: Belkasoft Live RAM Capturer

Search URL Search Domain Scan URL

URL: https://twitter.com/0gtweet/status/1273264867382788096?s=20
Title: Grzegorz Tworek - 0gtweet

Search URL Search Domain Scan URL

URL: https://www.magnetforensics.com/resources/?cat=Free%20Tool
Title: Magnet Forensics Tools

Search URL Search Domain Scan URL

URL: https://www.magnetforensics.com/free-tool-magnet-ram-capture
Title: Magnet RAM Capture

Search URL Search Domain Scan URL

URL: https://www.magnetforensics.com/resources/magnet-process-capture/
Title: Magnet Process Capture

Search URL Search Domain Scan URL

URL: https://www.volexity.com/blog/2018/06/12/surge-collect-provides-reliable-memory-acquisition-across-windows-linux-and-macos/
Title: Volexity Surge

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/livekd
Title: Microsoft LiveKd

Search URL Search Domain Scan URL

URL: https://github.com/Velocidex/c-aff4/releases
Title: Winpmem

Search URL Search Domain Scan URL

URL: https://accessdata.com/product-download
Title: FTK Imager (Cmd version, mostly GUI for new versions)

Search URL Search Domain Scan URL

URL: https://www.x-ways.net/order.html
Title: X-Ways Imager

Search URL Search Domain Scan URL

URL: https://www.guidancesoftware.com/encase-forensic
Title: Encase Forensic

Search URL Search Domain Scan URL

URL: https://www.guidancesoftware.com/tableau/download-center
Title: Tableau Imager

Search URL Search Domain Scan URL

URL: https://guymager.sourceforge.io/
Title: Guymager

Search URL Search Domain Scan URL

URL: https://twitter.com/barnabyskeggs
Title: Special thanks Barnaby Skeggs

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
Title: Quick overview of persistent locations (AutoRuns)

Search URL Search Domain Scan URL

URL: https://www.contextis.com/en/blog/common-language-runtime-hook-for-persistence
Title: Contextis Blog

Search URL Search Domain Scan URL

URL: https://github.com/jay/gethooks/releases/tag/1.01
Title: GetHooks

Search URL Search Domain Scan URL

URL: https://ericzimmerman.github.io/#!index.md
Title: MFTExplorer

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/4055535/how-to-disable-equation-editor-3-0
Title: More information on the below process

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1038/
Title: DLL Search Order Hijacking

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order
Title: Microsoft Docs

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/techniques/T1073/
Title: Dll Side Loading

Search URL Search Domain Scan URL

URL: https://learn-powershell.net/2014/05/09/quick-hits-list-all-available-wmi-namespaces-using-powershell/
Title: Enumerate WMI Namespaces

Search URL Search Domain Scan URL

URL: https://github.com/gentilkiwi/mimikatz/blob/master/kiwi_passwords.yar
Title: Mimikatz Yara rule

Search URL Search Domain Scan URL

URL: https://blog.xpnsec.com/exploring-mimikatz-part-1/
Title: Adam Chester

Search URL Search Domain Scan URL

URL: https://github.com/fox-it/danderspritz-evtx
Title: DanderSpritz eventlogedit

Search URL Search Domain Scan URL

URL: https://gist.github.com/JPMinty/f4d60adafdfbc12b0e4226a27bf1dcb0
Title: PowerShell Module to show Process Tree

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/secauthz/ace-strings
Title: ACE Strings

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/listdlls
Title: ListDLLs

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/4023262/how-to-verify-that-ms17-010-is-installed
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/strings
Title: Strings

Search URL Search Domain Scan URL

URL: https://github.com/Neo23x0/Loki
Title: Loki Scanner

Search URL Search Domain Scan URL

URL: https://www.crowdstrike.com/resources/community-tools/crowdresponse/
Title: Crowdresponse Scanner

Search URL Search Domain Scan URL

URL: https://binalyze.com/download/irec/
Title: IREC Tactical

Search URL Search Domain Scan URL

URL: https://github.com/virustotal/yara/releases/latest
Title: Yara

Search URL Search Domain Scan URL

URL: https://github.com/JPMinty/PowerShellArsenal
Title: PowerShellArsenal

Search URL Search Domain Scan URL

URL: https://gist.github.com/JPMinty/beffcd18d8ec06b73643c2f38cde384d
Title: Get-InjectedThread

Search URL Search Domain Scan URL

URL: https://github.com/rapid7/metasploit-framework/wiki/Meterpreter
Title: Meterpreter Wiki

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/4013567/how-to-disable-internet-explorer-on-windows
Title: More Information: MS Docs

Search URL Search Domain Scan URL

URL: https://github.com/BeanBagKing/EventFinder2
Title: Event Finder2

Search URL Search Domain Scan URL

URL: https://twitter.com/0gtweet/status/1182516740955226112
Title: Grzegorz Tworek - 0gtweet

Search URL Search Domain Scan URL

URL: https://github.com/sans-blue-team/DeepBlueCLI
Title: DeepblueCLI

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/etw/about-event-tracing
Title: Event Tracing Architecture

Search URL Search Domain Scan URL

URL: https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Title: post by Matt Graeber

Search URL Search Domain Scan URL

URL: https://twitter.com/spotheplanet
Title: Spotless

Search URL Search Domain Scan URL

URL: https://www.ired.team/miscellaneous-reversing-forensics/etw-event-tracing-for-windows-101
Title: crash course

Search URL Search Domain Scan URL

URL: https://plaso.readthedocs.io/en/latest/
Title: Plaso (Log2Timeline)

Search URL Search Domain Scan URL

URL: https://www.cyber.gov.au/acsc/view-all-content/advisories/advisory-2020-004-remote-code-execution-vulnerability-being-actively-exploited-vulnerable-versions-telerik-ui-sophisticated-actors
Title: Australian Cyber Security Centre

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)
Title: DSQuery

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc772217(v=ws.11)
Title: Netdom

Search URL Search Domain Scan URL

URL: https://adsecurity.org/?p=2398#MimikatzDCSync
Title: AD Security Blog by Sean Metcalf

Search URL Search Domain Scan URL

URL: https://github.com/clymb3r/PowerShell/blob/master/Invoke-NinjaCopy/Invoke-NinjaCopy.ps1
Title: Invoke-NinjaCopy

Search URL Search Domain Scan URL

URL: https://blog.ropnop.com/extracting-hashes-and-domain-info-from-ntds-dit/
Title: Ropnop - Extract Hashes and Domain Info

Search URL Search Domain Scan URL

URL: https://github.com/gdelugre/origami
Title: Github Download

Search URL Search Domain Scan URL

URL: https://github.com/ANSSI-FR/bmc-tools
Title: BMC-Tools

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc
Title: here

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/secauthz/impersonation-levels
Title: Microsoft

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
Title: wbadmin

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-date
Title: Get-Date

Search URL Search Domain Scan URL

URL: https://github.com/decalage2/oletools/wiki/olevba
Title: olevba

Search URL Search Domain Scan URL

URL: https://github.com/chrisjd20/power_dump
Title: powerdump

Search URL Search Domain Scan URL

URL: https://www.nirsoft.net/utils/ese_database_view.html
Title: ESE Database View

Search URL Search Domain Scan URL

URL: http://www.edgemanage.emmet-gray.com/Articles/ViewESE.html
Title: View ESE Database

Search URL Search Domain Scan URL

URL: https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
Title: Medium Post

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943
Title: File format specification

Search URL Search Domain Scan URL

URL: https://github.com/MarkBaggett/srum-dump
Title: SRUM-Dump

Search URL Search Domain Scan URL

URL: https://github.com/microsoft/etl2pcapng/releases
Title: Download

Search URL Search Domain Scan URL

URL: https://github.com/JPMinty/PowerShell/blob/master/Scripts/Convert-ROT13.ps1
Title: Convert-ROT13.ps1

Search URL Search Domain Scan URL

URL: https://www.nirsoft.net/utils/ie_cache_viewer.html
Title: IE Cache Viewer

Search URL Search Domain Scan URL

URL: https://www.foxtonforensics.com/browser-history-viewer/
Title: Browser History Viewer

Search URL Search Domain Scan URL

URL: https://www.nirsoft.net/utils/browsing_history_view.html
Title: Browsing History View

Search URL Search Domain Scan URL

URL: https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data#w_what-information-is-stored-in-my-profile
Title: More Information

Search URL Search Domain Scan URL

URL: https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries
Title: IEEE Webpage

Search URL Search Domain Scan URL

URL: https://www.wireshark.org/docs/man-pages/wireshark-filter.html
Title: General Wireshark Filter Reference

Search URL Search Domain Scan URL

URL: https://www.wireshark.org/docs/dfref/
Title: Full Wireshark Display Filter Reference

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/
Title: Customizing Wireshark – Changing Your Column Display

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/
Title: Using Wireshark – Display Filter Expressions

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/using-wireshark-identifying-hosts-and-users/
Title: Using Wireshark: Identifying Hosts and Users

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/using-wireshark-exporting-objects-from-a-pcap/
Title: Using Wireshark: Exporting Objects from a Pcap

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
Title: Wireshark Tutorial: Examining Trickbot Infections

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-ursnif-infections/
Title: Wireshark Tutorial: Examining Ursnif Infections

Search URL Search Domain Scan URL

URL: https://github.com/moxie0/sslstrip
Title: MITM Through SSLStrip

Search URL Search Domain Scan URL

URL: https://mitmproxy.org/
Title: MITM Through mitmproxy

Search URL Search Domain Scan URL

URL: https://wiki.wireshark.org/TLS#Using_the_.28Pre.29-Master-Secret
Title: Using the (Pre)-Master-Secret SSLKEYLOGFILE

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/archive/blogs/nettracer/decrypting-ssltls-sessions-with-wireshark-reloaded
Title: Using an RSA Private Key

Search URL Search Domain Scan URL

URL: https://github.com/woanware/usbdeviceforensics
Title: More Information

Search URL Search Domain Scan URL

URL: https://github.com/analyzeDFIR/analyzePF
Title: analyzePF

Search URL Search Domain Scan URL

URL: https://www.nirsoft.net/utils/win_prefetch_view.html
Title: WinPrefetchView

Search URL Search Domain Scan URL

URL: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
Title: PowerShell ♥ the Blue Team

Search URL Search Domain Scan URL

URL: https://powerforensics.readthedocs.io/en/latest/
Title: PowerForensics

Search URL Search Domain Scan URL

URL: https://github.com/google/grr
Title: Google Rapid Response

Search URL Search Domain Scan URL

URL: https://github.com/davehull/Kansa
Title: Kansa PowerShell IR Framework

Search URL Search Domain Scan URL

URL: https://grr-doc.readthedocs.io/en/latest/index.html
Title: GRR Docs

Search URL Search Domain Scan URL

URL: https://b2dfir.blogspot.com/2018/11/windows-powershell-remoting-host-based.html
Title: Thanks Barnaby Skeggs

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#administrative-tools-and-logon-types
Title: Microsoft Documentation

Search URL Search Domain Scan URL

URL: https://cert.europa.eu/static/WhitePapers/CERT-EU_SWP_17-002_Lateral_Movements.pdf
Title: Cert EU

Search URL Search Domain Scan URL

URL: http://www.dfrws.org/sites/default/files/session-files/characteristics_and_detectability_of_windows_auto-start_extensibility_points_in_memory_forensics.pdf
Title: Research Paper

Search URL Search Domain Scan URL

URL: https://gitlab.unizar.es/rrodrigu/winesap
Title: Volatility Plugin - Winesap

Search URL Search Domain Scan URL

URL: https://github.com/csababarta/volatility_plugins
Title: csababarta plugins

Search URL Search Domain Scan URL

URL: https://github.com/volatilityfoundation/volatility3/
Title: Version 3 of Volatility

Search URL Search Domain Scan URL

URL: https://volatility3.readthedocs.io/en/latest/basics.html
Title: ReadTheDocs

Search URL Search Domain Scan URL

URL: https://github.com/keydet89/RegRipper2.8
Title: RegRipper

Search URL Search Domain Scan URL

URL: https://learn.duffandphelps.com/kape
Title: Kape

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=L9H1uj2HSb8
Title: Video Tutorial

Search URL Search Domain Scan URL

URL: https://github.com/mandiant/ShimCacheParser
Title: ShimCaheParser

Search URL Search Domain Scan URL

URL: http://downloads.digitalcorpora.org/downloads/bulk_extractor/
Title: Bulk Extractor

Search URL Search Domain Scan URL

URL: https://www.forensicdots.de/
Title: ForensicDots

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Machine_Identification_Code
Title: Machine Identification Code

Search URL Search Domain Scan URL

URL: https://gchq.github.io/CyberChef/
Title: Cyber Chef

Search URL Search Domain Scan URL

URL: https://github.com/gchq/CyberChef
Title: Github

Search URL Search Domain Scan URL

URL: https://urlscan.io/
Title: URLScan

Search URL Search Domain Scan URL

URL: https://www.osquery.io/
Title: OSQuery

Search URL Search Domain Scan URL

URL: https://www.velocidex.com/docs/
Title: Velociraptor

Search URL Search Domain Scan URL

URL: https://github.com/kirk-sayre-work/ViperMonkey
Title: ViperMonkey

Search URL Search Domain Scan URL

URL: https://github.com/DissectMalware/XLMMacroDeobfuscator
Title: XLM Macro Deobfuscator

Search URL Search Domain Scan URL

URL: http://b2xtranslator.sourceforge.net/snapshots/BiffView.zip
Title: BiffView

Search URL Search Domain Scan URL

URL: https://arsenalrecon.com/downloads/
Title: Arsenal Image Mounter

Search URL Search Domain Scan URL

URL: https://accessdata.com/product-download/ftk-imager-version-4-2-1
Title: FTK Imager

Search URL Search Domain Scan URL

URL: https://www.sleuthkit.org/autopsy/download.php
Title: Autopsy

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/office365/securitycompliance/search-for-and-delete-messages-in-your-organization
Title: this documentation

Search URL Search Domain Scan URL

URL: https://github.com/comaeio/SwishDbgExt
Title: Comaeio SwishDbgExt

Search URL Search Domain Scan URL

URL: https://digital-forensics.sans.org/media/DFPS_FOR508_v4.6_4-19.pdf
Title: Excellent SANS Reference

Search URL Search Domain Scan URL

URL: https://github.com/504ensicsLabs/LiME/releases
Title: LiME

Search URL Search Domain Scan URL

URL: https://github.com/SekoiaLab/Fastir_Collector_Linux
Title: FastIR

Search URL Search Domain Scan URL

URL: https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
Title: LinEnum

Search URL Search Domain Scan URL

URL: https://bytefreaks.net/gnulinux/how-to-capture-all-network-traffic-of-a-single-process
Title: System Calls / Network Traffic

Search URL Search Domain Scan URL

URL: https://blog.apnic.net/2019/10/14/how-to-basic-linux-malware-process-forensics-for-incident-responders/
Title: Craig Rowland - Sandfly Security

Search URL Search Domain Scan URL

URL: https://twitter.com/iamevltwin
Title: Sarah Edwards

Search URL Search Domain Scan URL

URL: https://www.mac4n6.com/
Title: Mac4n6

Search URL Search Domain Scan URL

URL: https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
Title: SANS FOR518 Reference Sheet

Search URL Search Domain Scan URL

URL: https://forensicswiki.org/wiki/Mac_OS_X_10.9_-_Artifacts_Location
Title: Mac OS X 10.9 Forensics Wiki

Search URL Search Domain Scan URL

URL: https://forensicswiki.org/wiki/Mac_OS_X_10.11_(ElCapitan)_-_Artifacts_Location
Title: Mac OS X 10.11 Forensics Wiki

Search URL Search Domain Scan URL

URL: https://docs.google.com/spreadsheets/d/1X2Hu0NE2ptdRj023OVWIGp5dqZOw-CfxHLOW_GNGpX8/edit#gid=1317205466
Title: Mac OS X Forensics Artifacts Spreadsheet

Search URL Search Domain Scan URL

URL: https://www.objective-see.com/products/knockknock.html
Title: Quick Overview (KnockKnock)

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/
Title: MITRE ATT&CK™

Search URL Search Domain Scan URL

URL: https://car.mitre.org/
Title: MITRE Cyber Analytics Repository

Search URL Search Domain Scan URL

URL: https://redcanary.com/atomic-red-team/
Title: Atomic Red Team

Search URL Search Domain Scan URL

URL: https://github.com/meirwah/awesome-incident-response
Title: Awesome Incident Response

Search URL Search Domain Scan URL

URL: https://github.com/Cugu/awesome-forensics
Title: Awesome Forensics

Search URL Search Domain Scan URL

URL: https://github.com/n0fate/mac-osx-forensics
Title: Mac OSX Forensics

Search URL Search Domain Scan URL

URL: https://github.com/pstirparo/mac4n6
Title: Unofficial Mac 4n6 Resources

Search URL Search Domain Scan URL

URL: https://ss64.com/osx/
Title: Apple macOS command line (OS X bash)

Search URL Search Domain Scan URL

URL: https://www.youtube.com/13cubed
Title: 13Cubed

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=HcUMXxyYsnw
Title: John Strand Windows Live Forensics

Search URL Search Domain Scan URL

URL: https://www.dfir.training/resources/downloads/windows-registry
Title: DFIR Training Windows Registry

Search URL Search Domain Scan URL

URL: http://blog.commandlinekungfu.com/
Title: Commandlinekungfu

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787567(v=ws.10)
Title: Microsoft Audit Logon Events

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/desktop/CIMWin32Prov/win32-logonsession
Title: Windows Dev Win32_LogonSession

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=cYphLiySAC4
Title: Black Hills Information Security Windows Memory Forensics

Search URL Search Domain Scan URL

URL: https://forensicswiki.org/wiki/Main_Page
Title: Forensics Wiki

Search URL Search Domain Scan URL

URL: https://wiki.wireshark.org/DisplayFilters
Title: Wireshark Wiki

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Title: Microsoft Sysmon

Search URL Search Domain Scan URL

URL: https://github.com/AustralianCyberSecurityCentre/windows_event_logging
Title: ACSC Github

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus
Title: Windows Defender Docs

Search URL Search Domain Scan URL

URL: https://mikefrobbins.com/2013/12/19/using-powershell-to-remove-phishing-emails-from-user-mailboxes-on-an-exchange-server/
Title: Mikefrobbins

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/office365/securitycompliance/search-for-and-delete-messagesadmin-help
Title: Microsoft Office365

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/search-mailbox
Title: Microsoft Exchange

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
Title: Microsoft Threat Protection

Search URL Search Domain Scan URL

URL: https://adsecurity.org/?page_id=1821
Title: ADsecurity

Search URL Search Domain Scan URL

URL: https://twitter.com/wincmdfu
Title: Windows cmd fu

Search URL Search Domain Scan URL

URL: https://www.crowdstrike.com/blog/kovter-killer-how-to-remediate-the-apt-of-clickjacking/
Title: Crowdstrike

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/tip_of_the_day/2015/03/28/tip-of-the-day-reading-the-usn-journal/
Title: Technet Blog

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/rfc3227#section-2.1
Title: IETF RFC3227

Search URL Search Domain Scan URL

URL: https://www.cybereason.com/blog/adobe-worm-faker-uses-lolbins-and-dynamic-techniques-to-deliver-customized-payloads
Title: Cybereason Adobe Worm

Search URL Search Domain Scan URL

URL: https://medium.com/@melanijan93/windows-10-mail-app-forensics-39025f5418d2
Title: Melanijan93 Windows 10 mail forensics

Search URL Search Domain Scan URL

URL: https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware
Title: Cybereason Trickbot

Search URL Search Domain Scan URL

URL: https://www.datadigitally.com/2019/06/retrieving-memory-image-remotely.html
Title: Bryan Ambrose

Search URL Search Domain Scan URL

URL: https://twitter.com/Lee_Holmes
Title: Lee Holmes

Search URL Search Domain Scan URL

URL: https://www.bsk-consulting.de/2014/08/28/scan-system-files-manipulations-yara-inverse-matching-22/
Title: Florian Roth

Search URL Search Domain Scan URL

URL: https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
Title: Matt Graeber

Search URL Search Domain Scan URL

URL: https://social.technet.microsoft.com/wiki/contents/articles/4242.wmi-discovery-using-powershell.aspx
Title: Vasily Gusev

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
Title: MS Docs 4672

Search URL Search Domain Scan URL

URL: https://www.pdq.com/blog/modifying-the-registry-users-powershell/
Title: Kris

Search URL Search Domain Scan URL

URL: https://medium.com/@fahimhossain_16989/adding-startup-scripts-to-launch-daemon-on-mac-os-x-sierra-10-12-6-7e0318c74de1
Title: Fahim Hossain

Search URL Search Domain Scan URL

URL: https://www.linuxnix.com/linux-directory-structure-explainedetc-folder/
Title: Surendra Anne

Search URL Search Domain Scan URL

URL: https://digital-forensics.sans.org/media/SANS_Poster_2018_Hunt_Evil_FINAL.pdf
Title: SANS Hunt Evil

Search URL Search Domain Scan URL

URL: https://blogs.msdn.microsoft.com/servergeeks/2014/10/14/active-directory-files-and-their-functions/
Title: Habibar Rahmen - MSDN Blog

Search URL Search Domain Scan URL

URL: https://az4n6.blogspot.com/2014/10/timestomp-mft-shenanigans.html
Title: Mari DeGrazia

Search URL Search Domain Scan URL

URL: https://www.a12d404.net/windows/2019/10/30/schedsvc-persist-without-task.html
Title: Markus Piéton

Search URL Search Domain Scan URL

URL: https://github.com/sbousseaden/Slides/blob/master/Windows%20DFIR%20Events.pdf
Title: Samir

Search URL Search Domain Scan URL

URL: https://twitter.com/SBousseaden/status/1243711784101515274/photo/1
Title: Samir - Persistence

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html
Title: FireEye

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/download/details.aspx?id=36036
Title: Microsoft-Mitigating Pass-the-Hash Attacks

Search URL Search Domain Scan URL

URL: https://www.slideshare.net/bsmuir/windows-10-forensics-os-evidentiary-artefacts
Title: Brent Muir - Windows 10 Forensics

Search URL Search Domain Scan URL

URL: https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
Title: Mike Carey - Locked File Access Using ESENTUTL.exe

Search URL Search Domain Scan URL

URL: https://github.com/BornToBeRoot
Title: BornToBeRoot

Search URL Search Domain Scan URL

URL: https://malware-traffic-analysis.net/tutorials/index.html
Title: Malware-Traffic-Analysis - Brad Duncan

Search URL Search Domain Scan URL

URL: https://adsecurity.org/?p=3458
Title: ADsecurity - Detecting Kerberoasting Activity

Search URL Search Domain Scan URL

URL: https://github.com/eladshamir/Internal-Monologue
Title: eladshamir - Internal-Monologue

Search URL Search Domain Scan URL

URL: https://posts.specterops.io/defenders-think-in-graphs-too-part-1-572524c71e91
Title: Jared Atkinson - Defenders think in graphs too

Search URL Search Domain Scan URL

URL: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/more-excel-4-0-macro-malspam-campaigns/
Title: Diana Lopera - Trustwave

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/security/blog/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/?source=mmpc
Title: Microsoft - Where’s the Macro?

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?via=CyberRaiju&text=Digital+Forensics+and+Incident+Response%20https%3A%2F%2Fwww.jaiminton.com%2Fcheatsheet%2FDFIR%2F
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.jaiminton.com%2Fcheatsheet%2FDFIR%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.jaiminton.com%2Fcheatsheet%2FDFIR%2F
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.buymeacoffee.com/JaiMinton
Title: Buy me a coffee

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.jaiminton.com/cheatsheet/DFIR/ 370 KB
73 KB 156ms
119ms Document
text/html 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5c8bcdc0ec7b48412364e0c56cba4355ef8c4945df5533304691456bfd8d2cf

Request headers

:method: GET
:authority: www.jaiminton.com
:scheme: https
:path: /cheatsheet/DFIR/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 22 Oct 2020 00:03:36 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d7e7888f8205b90adcf73ac45fbe6ccf91603325015; expires=Sat, 21-Nov-20 00:03:35 GMT; path=/; domain=.jaiminton.com; HttpOnly; SameSite=Lax; Secure
last-modified: Wed, 21 Oct 2020 09:04:27 GMT
access-control-allow-origin: *
expires: Thu, 22 Oct 2020 00:13:35 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 4BFC:7AA9:4D3A264:51C4700:5F90CC57
via: 1.1 varnish
age: 0
x-served-by: cache-fra19136-FRA
x-cache: MISS
x-cache-hits: 0
x-timer: S1603325016.928904,VS0,VE96
vary: Accept-Encoding
x-fastly-request-id: f2a4335bd99a33f9c8aa2314c889a5eb6dfd326b
cf-cache-status: DYNAMIC
cf-request-id: 05ef374f6900002b35e5054000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5e5ef4c578492b35-FRA
content-encoding: br

GET
H2 200 main.css
www.jaiminton.com/assets/css/ 62 KB
12 KB 112ms
111ms Stylesheet
text/css 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/css/main.css
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2cfbdba5cd0f63606455f32ac200a707f91e0027e5c83989b2bcd09b69926e3

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 83c9e30541962b8504233ec53c9170031246356e
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
x-origin-cache: HIT
cf-request-id: 05ef374ff900002b3555bfe000000001
x-served-by: cache-fra19149-FRA
last-modified: Wed, 21 Oct 2020 09:04:27 GMT
server: cloudflare
x-github-request-id: FCA8:F96D:46884C8:4AAC212:5F90C1ED
x-timer: S1603325016.070666,VS0,VE88
etag: W/"5f8ff99b-f97b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4c6594f2b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:09 GMT

GET
H2 200 particles.js Show response
www.jaiminton.com/assets/js/ 42 KB
9 KB 113ms
112ms Script
application/javascript 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/js/particles.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89c8e085c3da89b31fd63bf88102068b931e58d1de9b64a2b29728ac28827d28

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: fea3196168d70ffe2435a26815ee9edd3afaf43a
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
cf-request-id: 05ef374ff900002b35fe26c000000001
x-served-by: cache-fra19133-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: D332:F96D:469C2D2:4AC230A:5F90CC57
x-timer: S1603325016.069525,VS0,VE91
etag: W/"5f8ff98d-a801"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4c659502b35-FRA
x-proxy-cache: MISS
expires: Thu, 22 Oct 2020 00:13:36 GMT

GET
H2 200 particlesjs-config.json Show response
www.jaiminton.com/assets/ 2 KB
799 B 107ms
106ms XHR
application/json 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/particlesjs-config.json
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/assets/js/particles.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e71a14b59c6cd81cd4262c163d05a16dc98709f28cb51b2dd24036f4f17d1089

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 6339f165f84e1e6095afe5a09bf0816ba996e75f
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
age: 0
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
cf-request-id: 05ef37507400002b354f3ef000000001
x-served-by: cache-fra19121-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: 1278:0BC3:10F9E40:122CA74:5F90CC57
x-timer: S1603325016.191745,VS0,VE87
etag: W/"5f8ff98d-7e0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5e5ef4c71a302b35-FRA
x-proxy-cache: MISS
expires: Thu, 22 Oct 2020 00:13:36 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 33ms
20ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-137357339-1

Requested by

Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

16c528bd4f29989275f17e0c2172c3a25a85cc50d6e9e984f7097330132e2cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 00:03:36 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37896
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 00:03:36 GMT

GET
H2 200 rootdir.png
www.jaiminton.com/assets/images/ 4 KB
5 KB 119ms
107ms Image
image/png 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/rootdir.png
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1bedf211350e28796f14c9fca55d693bc7b3694598a92bd6435d215c2f7658ec

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 5b4e3de24a6a7f9bf4eee3d94a0240ee0b95fe60
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
x-origin-cache: HIT
content-length: 4508
cf-request-id: 05ef37508100002b3541886000000001
x-served-by: cache-fra19134-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: 4D70:6093:497D2C9:4DD3E00:5F90C1EE
x-timer: S1603325016.207225,VS0,VE87
etag: "5f8ff98d-119c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4c73a482b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 bio-photo.jpg
www.jaiminton.com/assets/images/ 86 KB
86 KB 132ms
121ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/bio-photo.jpg
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 674ed777b8bbfa02cf6330cb45d6bc9624aa8c516e33666655dbf2d94a40fdb1

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 03c0173545b86c1dc45a15d7a242291067b1c3fc
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
x-origin-cache: HIT
content-length: 87774
cf-request-id: 05ef37508100002b352b8d0000000001
x-served-by: cache-fra19148-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: 7952:4DAB:4714716:4B4BAD0:5F90C1EE
x-timer: S1603325016.211055,VS0,VE88
etag: "5f8ff98d-156de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325016"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4c73a4a2b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 BlueTeam.jpg
www.jaiminton.com/assets/images/ 232 KB
233 KB 685ms
675ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/BlueTeam.jpg
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 089ef3196f5de5b2bd64fde04892f6b04888b2dab0fe579bcbe61f2a31b9689e

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: b4672073632e552a0066b2e26313a0c0d6eaefd1
date: Thu, 22 Oct 2020 00:03:36 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-length: 237994
cf-request-id: 05ef37508300002b353e336000000001
x-served-by: cache-fra19139-FRA
last-modified: Wed, 21 Oct 2020 09:04:12 GMT
server: cloudflare
x-github-request-id: E420:6092:251E941:276D227:5F90CC57
x-timer: S1603325016.206613,VS0,VE650
etag: "5f8ff98c-3a1aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325017"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4c73a4b2b35-FRA
x-proxy-cache: MISS
expires: Thu, 22 Oct 2020 00:13:36 GMT

GET
H2 200 PMALab.JPG
www.jaiminton.com/assets/images/ 217 KB
217 KB 132ms
113ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/PMALab.JPG
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8fa0a485f84c450dd0157b00c9f22a0ee4ae310133e83b2a678b522ca16efca

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 6fdcd534e2d8de7f1be950aff2a75940ce6e4314
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
x-origin-cache: HIT
content-length: 222222
cf-request-id: 05ef37573100002b351a020000000001
x-served-by: cache-fra19127-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: 6D6C:F969:265B06A:28B767F:5F90C1EE
x-timer: S1603325018.915930,VS0,VE86
etag: "5f8ff98d-3640e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4d1efa72b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 DefconDFIR.jpg
www.jaiminton.com/assets/images/ 84 KB
84 KB 160ms
142ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/DefconDFIR.jpg
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40f72f1f6869524ca1ae10f1d360502b7cb79b5a0965cdaba2c6b29a67fcb858

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 29e350cb3d2d362de340ca74c603ed302f379c5f
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
x-origin-cache: HIT
content-length: 85836
cf-request-id: 05ef37572f00002b35de25a000000001
x-served-by: cache-fra19162-FRA
last-modified: Wed, 21 Oct 2020 09:04:12 GMT
server: cloudflare
x-github-request-id: 90A0:DA1D:100AEEE:112F984:5F90C1FC
x-timer: S1603325018.920112,VS0,VE84
etag: "5f8ff98c-14f4c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4d1efa92b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:24 GMT

GET
H2 200 Querier.JPG
www.jaiminton.com/assets/images/ 35 KB
36 KB 234ms
216ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/Querier.JPG
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5897d0601031cd261116de7c7346a8a9bad0f0ec1aa00e8f9e9710d91becead3

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 5047bff74ef8086476b6d71a6fbeee1dd523103f
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
x-origin-cache: HIT
content-length: 35935
cf-request-id: 05ef37573000002b35172b3000000001
x-served-by: cache-fra19122-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: F622:F159:4527067:493BA15:5F90C1FA
x-timer: S1603325018.917139,VS0,VE101
etag: "5f8ff98d-8c5f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4d1efab2b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:24 GMT

GET
H2 200 Bastion.JPG
www.jaiminton.com/assets/images/ 31 KB
32 KB 207ms
189ms Image
image/jpeg 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.jaiminton.com/assets/images/Bastion.JPG
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d87b57865aa4d56f191dd769afdf80e36fc14b898f69c8e63b3db552eae6bbb6

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: e5329bc79d67ab4cae7bbf678f3f83afa55da385
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-length: 32100
cf-request-id: 05ef37573300002b35172b4000000001
x-served-by: cache-fra19144-FRA
last-modified: Wed, 21 Oct 2020 09:04:12 GMT
server: cloudflare
x-github-request-id: EDE4:645D:4D08673:5194535:5F90CC58
x-timer: S1603325018.922058,VS0,VE95
etag: "5f8ff98c-7d64"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5e5ef4d1efac2b35-FRA
x-proxy-cache: MISS
expires: Thu, 22 Oct 2020 00:13:37 GMT

GET
H2 200 main.min.js Show response
www.jaiminton.com/assets/js/ 114 KB
39 KB 126ms
108ms Script
application/javascript 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/js/main.min.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4914006e0525e89ff3d85e76aea1346550f10a86edda3435906c54a4636fd809

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 25e1033691f08807550b51713ffab4eab22c898b
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
x-origin-cache: HIT
cf-request-id: 05ef37572f00002b354e213000000001
x-served-by: cache-fra19149-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: CC18:0BC0:10C3D3:15B730:5F90C1EE
x-timer: S1603325018.912727,VS0,VE85
etag: W/"5f8ff98d-1c828"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4d1efa42b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 all.js Show response
use.fontawesome.com/releases/v5.7.1/js/ 1 MB
453 KB 114ms
26ms Script
application/javascript 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.7.1/js/all.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 06fbbb819a7f7c2e8b377f49130c5ae4654fbc734cacf7721ae46a6937b5aeb1

Request headers

Origin: https://www.jaiminton.com
Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 00:03:37 GMT
content-encoding: gzip
last-modified: Fri, 01 Feb 2019 18:49:42 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"ebb8d1549ec556961cdd7f87f7512edb"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 lunr.min.js Show response
www.jaiminton.com/assets/js/lunr/ 29 KB
8 KB 194ms
177ms Script
application/javascript 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/js/lunr/lunr.min.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b92711806ac89c3d959cf3698e6950b41d974552dccf2c99beb4e4622f9edf55

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 239a23662165bad7070ae1d45108c00d2e40a5ab
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
cf-request-id: 05ef37572f00002b351a01f000000001
x-served-by: cache-fra19137-FRA
last-modified: Wed, 21 Oct 2020 09:04:13 GMT
server: cloudflare
x-github-request-id: 3668:645C:2660173:28B95BE:5F90C1EE
x-timer: S1603325018.920167,VS0,VE87
etag: W/"5f8ff98d-72ba"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4d1efa52b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 lunr-store.js Show response
www.jaiminton.com/assets/js/lunr/ 569 KB
162 KB 188ms
114ms Script
application/javascript 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/js/lunr/lunr-store.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec51618c3447f2e69bc104cf8a753f7d3cba1aad799650cf31cc9f064e589284

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: c73e805d6240333edf4f1817d43415c6fa6203a0
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
cf-request-id: 05ef3757d800002b35172be000000001
x-served-by: cache-fra19142-FRA
last-modified: Wed, 21 Oct 2020 09:04:27 GMT
server: cloudflare
x-github-request-id: 9BCE:0BC5:46F9F78:4B2834C:5F90C1EE
x-timer: S1603325018.086094,VS0,VE90
etag: W/"5f8ff99b-8e4b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4d2f9242b35-FRA
x-proxy-cache: MISS
expires: Wed, 21 Oct 2020 23:29:10 GMT

GET
H2 200 lunr-en.js Show response
www.jaiminton.com/assets/js/lunr/ 2 KB
978 B 145ms
128ms Script
application/javascript 2606:4700:3031::681b:8041
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jaiminton.com/assets/js/lunr/lunr-en.js
Requested by: Host: www.jaiminton.com
URL: https://www.jaiminton.com/cheatsheet/DFIR/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:8041 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d9b1921104eb209f68f191e40db355a7929c9b45205b0cb5690234f3a6277fc

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 882f14527f05893b18fe98b0c8bbaa915368bb5a
date: Thu, 22 Oct 2020 00:03:38 GMT
via: 1.1 varnish
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cache: MISS
status: 200
x-cache-hits: 0
content-encoding: br
x-origin-cache: HIT
cf-request-id: 05ef37580b00002b350d325000000001
x-served-by: cache-fra19182-FRA
last-modified: Wed, 21 Oct 2020 09:04:27 GMT
server: cloudflare
x-github-request-id: 8C26:7AA9:4D3A2B3:51C474F:5F90CC58
x-timer: S1603325018.138376,VS0,VE85
etag: W/"5f8ff99b-9df"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603325018"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e5ef4d349752b35-FRA
x-proxy-cache: MISS
expires: Thu, 22 Oct 2020 00:13:38 GMT

GET css
fonts.googleapis.com/ 0
0

GET bmc-new-btn-logo.svg
cdn.buymeacoffee.com/buttons/ 0
0

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 11ms
6ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-137357339-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.jaiminton.com/cheatsheet/DFIR/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2874
date: Wed, 21 Oct 2020 23:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 22 Oct 2020 01:15:48 GMT

POST collect
www.google-analytics.com/j/ 0
0

GET collect
www.google-analytics.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin,latin-ext

Domain: cdn.buymeacoffee.com
URL: https://cdn.buymeacoffee.com/buttons/bmc-new-btn-logo.svg

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=74945382&t=pageview&_s=1&dl=https%3A%2F%2Fwww.jaiminton.com%2Fcheatsheet%2FDFIR%2F&ul=en-us&de=UTF-8&dt=Digital%20Forensics%20and%20Incident%20Response%20%3A%20Jai%20Minton&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=23199054&gjid=1546845874&cid=455723279.1603325025&tid=UA-137357339-1&_gid=742960952.1603325025&_r=1&gtm=2ou9u1&z=1334449604

Domain: www.google-analytics.com
URL: https://www.google-analytics.com/collect?v=1&_v=j86&a=74945382&t=timing&_s=2&dl=https%3A%2F%2Fwww.jaiminton.com%2Fcheatsheet%2FDFIR%2F&ul=en-us&de=UTF-8&dt=Digital%20Forensics%20and%20Incident%20Response%20%3A%20Jai%20Minton&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=9570&pdt=17&dns=14&rrt=0&srt=119&tcp=22&dit=6954&clt=7062&_gst=7074&_gbt=9516&_cst=307&_cbt=6870&_u=IEBAAUABAAAAAC~&jid=&gjid=&cid=455723279.1603325025&tid=UA-137357339-1&_gid=742960952.1603325025&z=61784146

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.jaiminton.com/	1970-01-19 13:22:05	Name: _gat_gtag_UA_137357339_1 Value: 1
.jaiminton.com/	1970-01-19 13:23:31	Name: _gid Value: GA1.2.742960952.1603325025
.jaiminton.com/	1970-01-20 06:53:17	Name: _ga Value: GA1.2.455723279.1603325025

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.jaiminton.com/cheatsheet/DFIR/(Line 126) Message: callback - particles.js config loaded
console-api	log	URL: https://www.jaiminton.com/assets/js/lunr/lunr-en.js(Line 21) Message: object

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.buymeacoffee.com
fonts.googleapis.com
use.fontawesome.com
www.google-analytics.com
www.googletagmanager.com
www.jaiminton.com
cdn.buymeacoffee.com
fonts.googleapis.com
www.google-analytics.com
23.111.9.35
2606:4700:3031::681b:8041
2a00:1450:4001:806::2008
2a00:1450:4001:824::200e
06fbbb819a7f7c2e8b377f49130c5ae4654fbc734cacf7721ae46a6937b5aeb1
089ef3196f5de5b2bd64fde04892f6b04888b2dab0fe579bcbe61f2a31b9689e
16c528bd4f29989275f17e0c2172c3a25a85cc50d6e9e984f7097330132e2cb6
1bedf211350e28796f14c9fca55d693bc7b3694598a92bd6435d215c2f7658ec
40f72f1f6869524ca1ae10f1d360502b7cb79b5a0965cdaba2c6b29a67fcb858
4914006e0525e89ff3d85e76aea1346550f10a86edda3435906c54a4636fd809
4d9b1921104eb209f68f191e40db355a7929c9b45205b0cb5690234f3a6277fc
5897d0601031cd261116de7c7346a8a9bad0f0ec1aa00e8f9e9710d91becead3
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
674ed777b8bbfa02cf6330cb45d6bc9624aa8c516e33666655dbf2d94a40fdb1
89c8e085c3da89b31fd63bf88102068b931e58d1de9b64a2b29728ac28827d28
a2cfbdba5cd0f63606455f32ac200a707f91e0027e5c83989b2bcd09b69926e3
b92711806ac89c3d959cf3698e6950b41d974552dccf2c99beb4e4622f9edf55
d5c8bcdc0ec7b48412364e0c56cba4355ef8c4945df5533304691456bfd8d2cf
d87b57865aa4d56f191dd769afdf80e36fc14b898f69c8e63b3db552eae6bbb6
d8fa0a485f84c450dd0157b00c9f22a0ee4ae310133e83b2a678b522ca16efca
e71a14b59c6cd81cd4262c163d05a16dc98709f28cb51b2dd24036f4f17d1089
ec51618c3447f2e69bc104cf8a753f7d3cba1aad799650cf31cc9f064e589284

www.jaiminton.com Open in urlscan Pro 2606:4700:3031::681b:8041 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

82 %HTTPS

75 %IPv6

6 Domains

6 Subdomains

5 IPs

2 Countries

1507 kBTransfer

3105 kBSize

3 Cookies

207 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

www.jaiminton.com Open in urlscan Pro
2606:4700:3031::681b:8041 Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

82 %
HTTPS

75 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

1507 kB
Transfer

3105 kB
Size

3
Cookies

22 HTTP transactions
0 data transactions