blogs.jpcert.or.jp Open in urlscan Pro
52.198.153.39 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true
Submission: On September 30 via api (September 30th 2024, 12:46:06 pm UTC) from IN — Scanned from JP

Summary HTTP 65 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 12 IPs in 4 countries across 8 domains to perform 65 HTTP transactions. The main IP is 52.198.153.39, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is blogs.jpcert.or.jp.
TLS certificate: Issued by Cybertrust Japan SureServer EV CA G3 on January 5th 2024. Valid for: a year.

This is the only time blogs.jpcert.or.jp was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
22	52.198.153.39 52.198.153.39	16509 (AMAZON-02) (AMAZON-02)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2404:6800:400... 2404:6800:4004:828::2008	15169 (GOOGLE) (GOOGLE)
14	35.78.25.103 35.78.25.103	16509 (AMAZON-02) (AMAZON-02)
6	210.231.184.214 210.231.184.214	2514 (INFOSPHER...) (INFOSPHERE NTT PC Communications)
5	151.101.228.157 151.101.228.157	54113 (FASTLY) (FASTLY)
2	2404:6800:400... 2404:6800:4004:827::200e	15169 (GOOGLE) (GOOGLE)
1	52.196.227.230 52.196.227.230	16509 (AMAZON-02) (AMAZON-02)
5	172.217.25.164 172.217.25.164	15169 (GOOGLE) (GOOGLE)
3	2404:6800:400... 2404:6800:400a:80e::200e	15169 (GOOGLE) (GOOGLE)
2	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
1	2404:6800:400... 2404:6800:4004:80a::200e	15169 (GOOGLE) (GOOGLE)
65	12

22 52.198.153.39 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

blogs.jpcert.or.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:828::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 35.78.25.103 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

movabletype.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 210.231.184.214 (Japan)

ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)
PTR: 210-231-184-214.pro.static.arena.ne.jp

pro.ranklet4.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.228.157 (San Francisco, United States)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2404:6800:4004:827::200e (Australia)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.196.227.230 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-196-227-230.ap-northeast-1.compute.amazonaws.com

ws.jpcert.or.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.25.164 (United States)

ASN15169 (GOOGLE, US)
PTR: sin01s16-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:400a:80e::200e (Osaka, Japan)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:6800:4004:80a::200e (Australia)

ASN15169 (GOOGLE, US)

clients1.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	jpcert.or.jp blogs.jpcert.or.jp ws.jpcert.or.jp	1 MB
14	movabletype.net movabletype.net	3 MB
8	google.com cse.google.com — Cisco Umbrella Rank: 3546 www.google.com — Cisco Umbrella Rank: 3 clients1.google.com — Cisco Umbrella Rank: 553	163 KB
7	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1617 syndication.twitter.com — Cisco Umbrella Rank: 2050	30 KB
6	ranklet4.com pro.ranklet4.com	14 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	21 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 57	273 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 257	6 KB
65	8

	Domain	Requested by
22	blogs.jpcert.or.jp	blogs.jpcert.or.jp
14	movabletype.net	blogs.jpcert.or.jp
6	pro.ranklet4.com	blogs.jpcert.or.jp
5	www.google.com	cse.google.com www.google.com blogs.jpcert.or.jp
5	platform.twitter.com	blogs.jpcert.or.jp platform.twitter.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	www.googletagmanager.com	blogs.jpcert.or.jp www.googletagmanager.com
2	syndication.twitter.com	blogs.jpcert.or.jp
2	cse.google.com	blogs.jpcert.or.jp www.google.com
1	clients1.google.com	blogs.jpcert.or.jp
1	ws.jpcert.or.jp	blogs.jpcert.or.jp
1	cdnjs.cloudflare.com	blogs.jpcert.or.jp
65	12

This site contains links to these domains. Also see Links.

Domain
www.jpcert.or.jp
github.com
jsac.jpcert.or.jp
blog.itochuci.co.jp
jpcertcc.github.io

Subject Issuer	Validity	Valid
blogs.jpcert.or.jp Cybertrust Japan SureServer EV CA G3	`2024-01-05` - `2025-01-31`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
movabletype.net Amazon RSA 2048 M02	`2024-02-11` - `2025-03-11`	a year	crt.sh
*.ranklet4.com E5	`2024-08-22` - `2024-11-20`	3 months	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ws.jpcert.or.jp Cybertrust Japan SureServer EV CA G3	`2024-01-05` - `2025-01-31`	a year	crt.sh
syndication.twitter.com R10	`2024-09-04` - `2024-12-03`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true
Frame ID: A246B76F0A61366EA27CB24FF63C629E
Requests: 62 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fblogs.jpcert.or.jp
Frame ID: F216BAAB876D40DB95257D2BE5A57480
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: C3F85DC1BD3D9318C05D014CBBB6544B
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Frame ID: 51F1F6B76AE54C995665F5562DB7D53E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MirrorFace Attack against Japanese Organisations - JPCERT/CC Eyes | JPCERT Coordination Center official Blog

Detected technologies

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

65
Requests

100 %
HTTPS

33 %
IPv6

8
Domains

12
Subdomains

12
IPs

4
Countries

4816 kB
Transfer

5981 kB
Size

4
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.jpcert.or.jp/english/

Search URL Search Domain Scan URL

URL: https://www.jpcert.or.jp/at/2023/at230029.html
Title: a security alert (Japanese)

Search URL Search Domain Scan URL

URL: https://github.com/JPCERTCC/aa-tools/blob/master/Deob_NOOPLDR.py
Title: https://github.com/JPCERTCC/aa-tools/blob/master/Deob_NOOPLDR.py

Search URL Search Domain Scan URL

URL: https://github.com/ginuerzh/gost
Title: https://github.com/ginuerzh/gost

Search URL Search Domain Scan URL

URL: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf
Title: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_7_hara_shoji_higashi_vickie-su_nick-dai_en.pdf

Search URL Search Domain Scan URL

URL: https://blog.itochuci.co.jp/entry/2024/01/24/134047
Title: https://blog.itochuci.co.jp/entry/2024/01/24/134047

Search URL Search Domain Scan URL

URL: https://github.com/joydo/d810
Title: https://github.com/joydo/d810

Search URL Search Domain Scan URL

URL: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf
Title: https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf

Search URL Search Domain Scan URL

URL: https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
Title: https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm

Search URL Search Domain Scan URL

URL: https://jpcertcc.github.io/ToolAnalysisResultSheet/details/vssadmin.htm
Title: https://jpcertcc.github.io/ToolAnalysisResultSheet/details/vssadmin.htm

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request mirrorface-attack-against-japanese-organisations.html Show response
blogs.jpcert.or.jp/en/2024/07/ 69 KB
17 KB 392ms
6ms Document
text/html 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a1621e130585831d259ddd60b724d8e04574f221a7c256b811f60800a92dcb92

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 19655
content-encoding: gzip
content-length: 16753
content-type: text/html; charset=utf-8
date: Mon, 30 Sep 2024 12:46:01 GMT
expect-ct: enforce, max-age=3600
strict-transport-security: max-age=3600
vary: Accept-Encoding
x-content-type-options: nosniff
x-runtime: 0.900537
x-xss-protection: 1; mode=block

GET
H2 200 styles.css
blogs.jpcert.or.jp/en/common/css/ 37 KB
8 KB 8ms
4ms Stylesheet
text/css 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/css/styles.css

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

6f7505af235b3dec440dedfbc35698ffd35372032e9c0122afc003636ea894b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
age: 20862
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 8161
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: text/css
vary: Accept-Encoding
x-runtime: 0.052221

GET
H3 200 font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 37 KB
6 KB 50ms
23ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://blogs.jpcert.or.jp
Referer: https://blogs.jpcert.or.jp/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e5f-9226"
age: 941194
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xGEu6XW87C3ls5lDjtduefN0IH6kRfOrOFekUCw8GOanGkoU22cik3opFZfd22kPTdR9m2%2F4Feh4pqShvA%2BpgHPpQJtLWM%2FbujiQzxbT1DcwmQoDPf9uK%2FijZ55vt54bVTmHdUc"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 20 Sep 2025 12:46:01 GMT
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 04 May 2020 16:10:07 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cb4503aeec1e045-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5884
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
74 KB 104ms
56ms Script
application/javascript 2404:6800:4004:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:828::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8ff4087a3a8cd84f531cc004b828d38109d3010a17b2e2a41915c8907c85f9d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 75021
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 294 KB
100 KB 105ms
57ms Script
application/javascript 2404:6800:4004:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:828::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

81bce6f5dca2c1af2a19e0b92f59a68bf3dd4a865e0d86f5212af7eafd97d0c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101995
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 header_logo.svg
blogs.jpcert.or.jp/en/common/images/ 3 KB
2 KB 7ms
5ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/header_logo.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
etag: W/"470f7c2a7f953ad63a2f660ce00a9ef3"
x-amz-version-id: 7PlhVPaL1XdtPVOkYQdVycFCOo3AsXaK
age: 249353
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 1449
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/svg+xml
last-modified: Fri, 09 Oct 2020 02:20:14 GMT
x-runtime: 0.046091
vary: Accept-Encoding

GET
H2 200 ENCORE_400x400.jpg
movabletype.net/users/shu_tom/ 64 KB
65 KB 145ms
128ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/shu_tom/ENCORE_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

7fe1a58ea8b8fdfaca777d67aab3b8c3162591f5370294c693fbf6713b563bee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "e6e4162bb599969e44d37cb379a6db54"
x-amz-version-id: ZSziZ7mhrWfa6SnVIF9Z5BQnQABGuZ_s
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 65659
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 03 Oct 2018 05:27:14 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 mirrorface-fig1-640wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 91 KB
92 KB 10ms
9ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/mirrorface-fig1-640wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ff861020b28433e34b45e616f29e4b82f124aad013b678a916d47274a3fa142d

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "f2452fabdff356d244edeb8cc0d32ff6"
age: 69173
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 93652
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 12 Sep 2024 12:26:13 GMT
x-amz-expiration: expiry-date="Wed, 23 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.089258
x-amz-server-side-encryption: AES256

GET
H2 200 mirrorface-fig2-640wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 104 KB
105 KB 16ms
16ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/mirrorface-fig2-640wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

70d94eb165a7fbeb4e4b7a6287db82e9b0ad308579eaadc032d36e80eb88ba9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "735d1bcfd0767b468434f1a048bf9b25"
age: 69168
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 106825
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 12 Sep 2024 07:16:19 GMT
x-amz-expiration: expiry-date="Wed, 23 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.086267
x-amz-server-side-encryption: AES256

GET
H2 200 mirrorface-fig3-640wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 88 KB
89 KB 18ms
18ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/mirrorface-fig3-640wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

1fcf9d4554d76487710bf29c1ce350bdc068a59469c3ba2a2ea6842d4f343a9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "40b1fba9379f8429d72b72691b9cd537"
age: 242019
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 90215
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 12 Sep 2024 07:16:19 GMT
x-amz-expiration: expiry-date="Wed, 23 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.058967
x-amz-server-side-encryption: AES256

GET
H2 200 mirrorface-fig4-640wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 368 KB
369 KB 13ms
7ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/mirrorface-fig4-640wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a2e10042ac4f32ed3a8483d21cefc2a38f32fae538f56021d5b3138abd620383

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "da1ac5b3fd29a5dd96225740bd6add29"
age: 69158
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 377160
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 12 Sep 2024 07:16:18 GMT
x-amz-expiration: expiry-date="Wed, 23 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.052078
x-amz-server-side-encryption: AES256

GET
H2 200 mirrorface-fig5-640wri.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 397 KB
398 KB 13ms
8ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/mirrorface-fig5-640wri.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

040b7d2bad999ab19ce77cb0816e33ff499f42f000948ce43477482ef0870e53

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "8fae1c9175a0fb3043a9ae33755d178a"
age: 69149
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 406723
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 12 Sep 2024 07:16:18 GMT
x-amz-expiration: expiry-date="Wed, 23 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.074660
x-amz-server-side-encryption: AES256

GET
H2 200 fb_loader.gif
blogs.jpcert.or.jp/en/common/images/ 889 B
1 KB 13ms
8ms Image
image/gif 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/fb_loader.gif

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

2ec9087635398a0a4f08808b2d5bd3af37542c290314c060303ee3a41e7af6bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "86ca4d6e0539b88294cdf7e757b79455"
x-amz-version-id: teKMG5tddGNKpEgVSFdR5NGD.rr0iMNz
age: 230325
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 889
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/gif
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.047459

GET
H2 200 202310_domain_hijacking2_en-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 38 KB
39 KB 13ms
8ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/202310_domain_hijacking2_en-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

7ecf5c4eac9ac965236717659e8dfb77a07e7d30b432fc1ca605df535d36e187

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "4a3939ad634ba9afb83932ba910b109a"
age: 17155
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 39394
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Sun, 08 Sep 2024 20:37:46 GMT
x-amz-expiration: expiry-date="Sat, 19 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.068707
x-amz-server-side-encryption: AES256

GET
H2 200 bigip-exploit-fig2-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 54 KB
54 KB 13ms
8ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/bigip-exploit-fig2-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

8f9b55020e7cc565c19802aadbb037ca8d79317b92c0969e1f58c70ec37501a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "b6e59a7c263f679c0e92bc52384570e6"
age: 99949
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 54966
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Fri, 20 Sep 2024 05:18:04 GMT
x-amz-expiration: expiry-date="Thu, 31 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.091603
x-amz-server-side-encryption: AES256

GET
H2 200 phishurl-fig1-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 45 KB
45 KB 16ms
11ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/phishurl-fig1-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

541e7e2b59e866c63fbfd0d4144a3d21f7ed0c0bec77557555fef95d3d868040

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "879c867c14245cb5c83d6c670ce422fc"
age: 155660
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 45744
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Tue, 10 Sep 2024 07:26:39 GMT
x-amz-expiration: expiry-date="Mon, 21 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.077633
x-amz-server-side-encryption: AES256

GET
H2 200 2021report-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 15 KB
16 KB 21ms
15ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/2021report-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

b97d6ad69550a314a89563c1877d76d4e80a01a0d88c7083aa85c0f0d5b32e6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "a96293efb8c36bae86b7557b4050224b"
age: 99949
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 15584
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 05 Sep 2024 00:41:27 GMT
x-amz-expiration: expiry-date="Wed, 16 Oct 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.070279
x-amz-server-side-encryption: AES256

GET
H2 200 01_en-320wi.png
blogs.jpcert.or.jp/en/.assets/thumbnail/ 28 KB
29 KB 20ms
15ms Image
image/png 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/.assets/thumbnail/01_en-320wi.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

3fe28539e1748678b784696a87f1ed41b2aa3bea2399c1f30d8f921769634107

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "d75cb6337c4dc6f1c96abee1b77253de"
age: 69140
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 28822
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Tue, 24 Sep 2024 17:32:30 GMT
x-amz-expiration: expiry-date="Mon, 04 Nov 2024 00:00:00 GMT", rule-id="RemoveOldData"
x-runtime: 0.064813
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK N2r04NQy9WPJiTSHTadz.js Show response
pro.ranklet4.com/widgets/ 7 KB
2 KB 19ms
5ms Script
text/javascript 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.ranklet4.com/widgets/N2r04NQy9WPJiTSHTadz.js
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),
Reverse DNS: 210-231-184-214.pro.static.arena.ne.jp
Software: nginx/1.26.1 /
Resource Hash: 6306901b0d07da0ebe3b88d092442106cf98919ba3669adabcc2d3f6e759cecc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

x-amz-server-side-encryption: AES256
Content-Encoding: gzip
ETag: "94b11bd03f52a9edb0f9ce48cb3a77e1"
Connection: keep-alive
x-amz-request-id: GAX4MSPZ6M3JGXF3
Accept-Ranges: bytes
X-Cache: HIT
Content-Length: 1510
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: text/javascript
Last-Modified: Mon, 30 Sep 2024 09:07:51 GMT
Server: nginx/1.26.1
x-amz-id-2: +jfIveBt9xTMgQtdLl8UE87Wg5PEFKrDd5Lxey6506YYTUZK63iCGeVFJqbuahtBAdmWGfAX6Rw=

GET
H2 200 matsu.png
movabletype.net/users/SHIKAPON/ 579 KB
580 KB 131ms
116ms Image
image/png 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/SHIKAPON/matsu.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

d0777e2e2c6a47608109aa789d1f8769aa6b972da30e0ffaf631a1fefbf31fd4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "f042b8ca8c2df4e375d83530eea4d1b2"
x-amz-version-id: 4CqEq9yloEXP.7_Aa3yLht9hpURhskiF
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 593069
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Wed, 26 Sep 2018 07:36:08 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 default-userpic-90.jpg
blogs.jpcert.or.jp/en/common/images/ 634 B
953 B 20ms
15ms Image
image/jpeg 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/default-userpic-90.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

bff0831e53ffe4da0fc58d076aafffae2e6f46b7210f7f2d08c2b88c53304fe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "5a94d27506940168f6de59eb32f920dc"
x-amz-version-id: Hnbukdk4pnKX3_Jdrtqqb2JY3w31WOp_
age: 255420
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 634
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/jpeg
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.021211

GET
H2 200 Q6VN1jSR_400x400.jpg
movabletype.net/users/reto/ 61 KB
62 KB 121ms
105ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/reto/Q6VN1jSR_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

23fd61c6a9f5a2c1d58d42eebce6f72a1e0838eafcd8adb349ee85b1024db128

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "0280c12bed1fc39e5dd1ace0986264ab"
x-amz-version-id: 5CyHQUgE0cDtK5ZBTTH8nuPiZLj4rNoJ
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 62701
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 25 Mar 2020 01:50:50 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 profile_icon.png
movabletype.net/users/ikuya/ 209 KB
210 KB 84ms
69ms Image
image/png 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/ikuya/profile_icon.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

10de10394a37304a0c94242badee67380313edf5d99f963126c0660f7115315f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "0ff73c7fe128b36457b0d8d582689949"
x-amz-version-id: 6aNgdxXWGy8r9Je1nvYiwKC3aPMq0TOL
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 214306
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 04 Apr 2019 03:31:39 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 photo_sparky_small.jpg
movabletype.net/users/kkomiyama/ 94 KB
95 KB 100ms
85ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/kkomiyama/photo_sparky_small.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

90bfb0ff383c74405328fce0fcfa8544f0a8549f9d3d18c3245dd8fb54f6a65e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "b97364fc77ea6e5b13cb43a6a4be63bf"
x-amz-version-id: OEfSIkB0RGovJcaXq6G39aw4RboYWtHl
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 96469
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 03 Oct 2018 05:08:05 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 blog_image.png
movabletype.net/users/masubuchi/ 590 KB
591 KB 93ms
78ms Image
image/png 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/masubuchi/blog_image.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

46e2a1c601fb504a72bfdca8785474711d40549df3a0f73cef2474e4f3c66476

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "f40ace5c0be0a709e386e540a5721f51"
x-amz-version-id: LJ6qoYQ_vcq3zigInkn5q7BD.yiOZuYR
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 603691
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Fri, 16 Apr 2021 09:36:36 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 %E7%94%BB%E5%83%8F%E3%81%AE%E8%B2%BC%E3%82%8A%E4%BB%98%E3%81%91%E5%85%88_-2021-3-18-22-18.png
movabletype.net/users/hori-32tk/ 498 KB
499 KB 83ms
81ms Image
image/png 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/hori-32tk/%E7%94%BB%E5%83%8F%E3%81%AE%E8%B2%BC%E3%82%8A%E4%BB%98%E3%81%91%E5%85%88_-2021-3-18-22-18.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

e502f0bbfcb50ab822ce1f941eed85eb4628a4e301132e1dcb047f5b96a55900

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "3f84e9e59a0216813f9868cdb0750a58"
x-amz-version-id: tsBKAQ7ddCyKP5DFD715zfoyWgcV9zJt
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 509789
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Thu, 18 Mar 2021 13:18:53 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 image-992ce083-832a-45c5-a3d8-5922b68506a7.jpg
movabletype.net/users/kino/ 81 KB
82 KB 104ms
102ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/kino/image-992ce083-832a-45c5-a3d8-5922b68506a7.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

d025d624352f8a6ceec63d1be3f7513b4874d370d224a3011620d20c03276e2e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "e1c0b0f3e14981fa62431e8e3dee6b24"
x-amz-version-id: rm7cfsZ5Ce6oLWec3yfNemazc91RQBCq
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 83292
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 19 Feb 2020 02:36:54 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 14190908.jpg
movabletype.net/users/uchida/ 56 KB
56 KB 62ms
60ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/uchida/14190908.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

23e6d93452a4c0db3f01dfcdcef099dfe3e9861eb3b03ea07ae1878d63b7d412

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "27bdb7b931ee101c812d31c210c562ee"
x-amz-version-id: xSjrABhuC5_UsXL2kH2LUKWQ_9rQM.jm
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 57308
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 14 Nov 2018 02:44:17 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 Sajo0191031.jpg
movabletype.net/users/sajo/ 42 KB
42 KB 111ms
109ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/sajo/Sajo0191031.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

830ae81a7374748dc123821adcb7c0548ba35d4f16b74c234aa8a0dba1729960

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "46a715f26415fd287dd8d636e655227a"
x-amz-version-id: nK1wfC4U_YAKdNPjnfFNOz6hYlZz6Hwo
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 42964
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Mon, 02 Dec 2019 04:26:56 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 Tomotaka-Ito.jpg
movabletype.net/users/Tomotaka/ 33 KB
33 KB 91ms
89ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/Tomotaka/Tomotaka-Ito.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

a6653a5760c7cea6cdad209d739f01c8436527a428fa218459716fab12ce37cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "2cf4a537d5062bfa194893d424988d62"
x-amz-version-id: 2fvcyuaHrwAXr_kpyHORm2o39hfGCEKt
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 33853
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Thu, 03 Dec 2020 15:10:39 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 default-userpic-90.jpg
movabletype.net/users/tnakano/ 832 B
1 KB 91ms
89ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/tnakano/default-userpic-90.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

db202f6b1909fb514275f7d608e1497fa95e8ba8f850c8909b1927cf11f85e52

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

x-frame-options: sameorigin
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
x-amz-version-id: rkhmeUk7DoOh.CA_DZpezULC6kVHyLQL
etag: "3de507977021a6e538d85c4f23549ec2"
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 832
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Wed, 06 Dec 2023 06:58:16 GMT
server: openresty
x-amz-server-side-encryption: AES256

GET
H2 200 DSCN1042-(2).png
movabletype.net/users/shoko/ 555 KB
556 KB 83ms
82ms Image
image/png 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/shoko/DSCN1042-(2).png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

36ba36d6118ad765aa17b49bcc2d3fc44379b1c8715cabc60bda192ad0a79261

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

x-frame-options: sameorigin
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
x-amz-version-id: gn1ENFMTC8XJoZacN7.XPNO_LiNxcra.
etag: "c5f4e594f6c0a33267016d18f4aa0b36"
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 568417
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/png
last-modified: Wed, 10 May 2023 04:30:01 GMT
server: openresty
x-amz-server-side-encryption: AES256

GET
H2 200 j_icon72_400x400.jpg
movabletype.net/users/retiree_blog/ 29 KB
29 KB 83ms
81ms Image
image/jpeg 35.78.25.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://movabletype.net/users/retiree_blog/j_icon72_400x400.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.78.25.103 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-78-25-103.ap-northeast-1.compute.amazonaws.com

Software

openresty /

Resource Hash

92f1bc2e6be6094ffa0bd7ba2538fb71e6aadfd481c2b762c35a4b5559380a6d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: frame-ancestors 'self'
etag: "0678b8fce84b34cf896501f2e5bd184a"
x-amz-version-id: fP9rPqYkUqVXLZFK4aYyKZ4lsm.JbgHp
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 29768
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 1; mode=block
content-type: image/jpeg
last-modified: Thu, 04 Oct 2018 05:28:49 GMT
server: openresty
x-frame-options: sameorigin

GET
H2 200 footer_logo.svg
blogs.jpcert.or.jp/en/common/images/ 3 KB
2 KB 19ms
16ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/footer_logo.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
etag: W/"470f7c2a7f953ad63a2f660ce00a9ef3"
x-amz-version-id: Cx1bNBQORdTZDbUNftTAcH.2LEt5sDW2
age: 255420
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 1443
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/svg+xml
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.050007
vary: Accept-Encoding

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 13ms
2ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Mon, 30 Sep 2024 12:46:01 GMT
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kjyo7100044-IAD, cache-hnd18740-HND
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27597
x-amz-server-side-encryption: AES256

GET
H2 200 prototype.js Show response
blogs.jpcert.or.jp/en/common/js/ 168 KB
48 KB 13ms
7ms Script
application/javascript 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/js/prototype.js

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

d0496587eb0e1b42d3614c76d3e0a76290f7a5139940cc2cd8c195cbcab39b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
etag: W/"c052d39fe57096c11105495ae5eaa363"
x-amz-version-id: N0KlEhkLkgpbiO2iNalwwcYGYXmQIPcc
age: 258374
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 48395
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.022639
vary: Accept-Encoding

GET
H2 200 script.js Show response
blogs.jpcert.or.jp/en/common/feedback/ 6 KB
3 KB 14ms
7ms Script
application/javascript 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/feedback/script.js

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

64871e8b15628e5023849cfadc90ec6482233a8260fb39d32458e94ebfbc5de5

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
etag: W/"95fc36ba90d76fcaacd9b49a254fd6a5"
x-amz-version-id: WKblPiUK5m0VfpbMlZmR5cNpURSAe3r4
age: 242443
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 2527
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.021587
vary: Accept-Encoding

GET
H2 200 cse.js Show response
cse.google.com/ 6 KB
3 KB 114ms
65ms Script
text/javascript 2404:6800:4004:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:827::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

f16e506333607b7cc9a7dfb8696f183a41be2d3e9937fc470108db718e20cd56

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-7H0sKX7fUlysn7_AULmpOQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-7H0sKX7fUlysn7_AULmpOQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
content-encoding: br
accept-ch: Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2614
date: Mon, 30 Sep 2024 12:46:01 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: gws
x-frame-options: SAMEORIGIN

GET
H2 200 bg_header.jpg
blogs.jpcert.or.jp/en/common/images/ 79 KB
80 KB 18ms
16ms Image
image/jpeg 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/bg_header.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/css/styles.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

261c7d35b8070f9e07d90aec18fe37b29b78e49cbbdb13c279efda50dc92cbfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/common/css/styles.css

Response headers

strict-transport-security: max-age=3600
etag: "36b8b54cd6c4d3cedb6f1fab7973bd13"
x-amz-version-id: 1LYFnOgGMu3b7ap_0FNaHRLj.1SCoQ94
age: 255420
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 81378
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/jpeg
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.050687

GET
H2 200 icon-mail.svg
blogs.jpcert.or.jp/en/common/images/ 334 B
620 B 17ms
16ms Image
image/svg+xml 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/en/common/images/icon-mail.svg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/css/styles.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

eba8d7f3703d70c73f3403a2754b3b41c92e4aeaaabdbdd417585bfefd49eec3

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/common/css/styles.css

Response headers

strict-transport-security: max-age=3600
content-encoding: gzip
etag: W/"cdfcff7746225765d03d1b1fe8135ca9"
x-amz-version-id: iRtpKkMVBni00J5p7Fi1DUAc6G11sxXt
age: 230323
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 263
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/svg+xml
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.023233
vary: Accept-Encoding

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSW5mb0tleS04MDB3aS5wbmc.jpg
pro.ranklet4.com/imgproxy/SNoqIVNVHyPzr8sqrUSqzReBeh4kidqIRjhzJonsTXA/rs:fit:160:160/q:75/sm:1/ 2 KB
2 KB 5ms
4ms Image
image/jpeg 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/SNoqIVNVHyPzr8sqrUSqzReBeh4kidqIRjhzJonsTXA/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvSW5mb0tleS04MDB3aS5wbmc.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-214.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

6a2fbbe670d3e049df7de0e20f3698882ed9783e47a010e1b0c2c746b919091c

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

X-Request-Id: THCPhCK-h9PeiAoVFBEZq
Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000, public
Connection: keep-alive
Expires: Thu, 10 Jul 2025 01:06:50 GMT
X-Cache: HIT
Content-Length: 1826
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: image/jpeg
Content-Disposition: inline; filename="InfoKey-800wi.jpg"
Server: nginx/1.26.1

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvdm9sYXRpbGl0eTMtODAwd2kucG5n.jpg
pro.ranklet4.com/imgproxy/E27DmGDKu1R0qbL8Iog33aY7Yd-klh4Hz9hW0FldE3k/rs:fit:160:160/q:75/sm:1/ 2 KB
3 KB 8ms
3ms Image
image/jpeg 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/E27DmGDKu1R0qbL8Iog33aY7Yd-klh4Hz9hW0FldE3k/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvdm9sYXRpbGl0eTMtODAwd2kucG5n.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-214.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

6a52e408e0c5186de02719f1755dd12c48814f80a99580900213446abb2e593a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

X-Request-Id: hgVlTx8IjHy28Rmg-oj-g
Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000, public
Connection: keep-alive
Expires: Thu, 10 Jul 2025 01:06:50 GMT
X-Cache: HIT
Content-Length: 2359
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: image/jpeg
Content-Disposition: inline; filename="volatility3-800wi.jpg"
Server: nginx/1.26.1

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvMDMtODAwd2kuanBn.jpg
pro.ranklet4.com/imgproxy/6oKY2Hgudik94XC29C95P0i1NTZgDRecCbq1iFp4N9g/rs:fit:160:160/q:75/sm:1/ 2 KB
2 KB 3ms
3ms Image
image/jpeg 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/6oKY2Hgudik94XC29C95P0i1NTZgDRecCbq1iFp4N9g/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvMDMtODAwd2kuanBn.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-214.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

62173c7f7a3f43f2beb1f3a35a68dbfc8738b3b0d00bdc6290427eaa1d33df16

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

X-Request-Id: xoNTyhJPLS_ir_5v1a2nu
Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000, public
Connection: keep-alive
Expires: Thu, 10 Jul 2025 01:06:50 GMT
X-Cache: HIT
Content-Length: 2118
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: image/jpeg
Content-Disposition: inline; filename="03-800wi.jpg"
Server: nginx/1.26.1

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvJUUzJTgzJUFEJUUzJTgyJUI0LTgwMHdpLmpwZw.jpg
pro.ranklet4.com/imgproxy/oD9UIVAi7QaQhfIKlzI6LSf9Yh8bUkcrzAPefgyJqLA/rs:fit:160:160/q:75/sm:1/ 1 KB
2 KB 3ms
3ms Image
image/jpeg 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/oD9UIVAi7QaQhfIKlzI6LSf9Yh8bUkcrzAPefgyJqLA/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvJUUzJTgzJUFEJUUzJTgyJUI0LTgwMHdpLmpwZw.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-214.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

3eb59031e11a678d81f252f9bbde2c7485376af26fb50b2d5099497e8de378a3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

X-Request-Id: pv4nRAxgPaqTVUjJRlYpB
Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000, public
Connection: keep-alive
Expires: Thu, 10 Jul 2025 01:06:50 GMT
X-Cache: HIT
Content-Length: 1508
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: image/jpeg
Content-Disposition: inline; filename="ãã´-800wi.jpg"
Server: nginx/1.26.1

GET
H/1.1 200
OK aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvRGFuZ2Vyb3VzUGFzc3dvcmQtZmlnMy04MDB3aS5wbmc.jpg
pro.ranklet4.com/imgproxy/0F1nxMToMYcwAw-_Sxfgawgq2Ji0OnjPMWijyDwHq6U/rs:fit:160:160/q:75/sm:1/ 3 KB
3 KB 3ms
3ms Image
image/jpeg 210.231.184.214
INFOSPHERE NTT PC...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pro.ranklet4.com/imgproxy/0F1nxMToMYcwAw-_Sxfgawgq2Ji0OnjPMWijyDwHq6U/rs:fit:160:160/q:75/sm:1/aHR0cHM6Ly9ibG9ncy5qcGNlcnQub3IuanAvZW4vLmFzc2V0cy90aHVtYm5haWwvRGFuZ2Vyb3VzUGFzc3dvcmQtZmlnMy04MDB3aS5wbmc.jpg

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

210.231.184.214 , Japan, ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP),

Reverse DNS

210-231-184-214.pro.static.arena.ne.jp

Software

nginx/1.26.1 /

Resource Hash

fff8c4b16d509b3a3dfd540786931080018d74abd3190e7723cf6e914a93ce95

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

X-Request-Id: scQcO9qPHQ3jjK8tOTl6t
Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000, public
Connection: keep-alive
Expires: Fri, 19 Sep 2025 20:05:18 GMT
X-Cache: HIT
Content-Length: 3030
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: image/jpeg
Content-Disposition: inline; filename="DangerousPassword-fig3-800wi.jpg"
Server: nginx/1.26.1

GET
H2 200 fb_loader.gif
blogs.jpcert.or.jp/common/feedback/images/ 4 KB
4 KB 4ms
4ms Image
image/gif 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.jpcert.or.jp/common/feedback/images/fb_loader.gif

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

684476872d3b64b3fbb972c14b1d21d4bde8b6c8074a644f93e234764f542ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "2acb729ed298b6a3f2455e651bb5d876"
x-amz-version-id: rraXNl8QFXJ4DUlZOhqk4kUmZQBo6KKB
age: 18879
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 3917
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: image/gif
last-modified: Fri, 09 Oct 2020 02:03:44 GMT
x-runtime: 0.021527

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame F216 0
0 5ms
1ms Document
text/html 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fblogs.jpcert.or.jp
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Mon, 30 Sep 2024 12:46:01 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kjyo7100176-IAD, cache-hnd18735-HND

GET
H/1.1 200
OK get_feedback_jsonp.cgi Show response
ws.jpcert.or.jp/cgi-bin/ 155 B
386 B 25ms
11ms Script
application/javascript 52.196.227.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.jpcert.or.jp/cgi-bin/get_feedback_jsonp.cgi?uri=/en/2024/07/mirrorface-attack-against-japanese-organisations.html&_d=1727700361555
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/common/feedback/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.196.227.230 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-196-227-230.ap-northeast-1.compute.amazonaws.com
Software: Apache /
Resource Hash: f28190ed8f8ff694cf05496cbd67f9f2093a0e9c8e5caf7d0deb5939bd2f37c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

Upgrade: h2,h2c
Transfer-Encoding: chunked
Keep-Alive: timeout=5, max=100
Date: Mon, 30 Sep 2024 12:46:01 GMT
Content-Type: application/javascript
Server: Apache
Connection: Upgrade, Keep-Alive

GET
H3 200 cse_element__ja.js Show response
www.google.com/cse/static/element/8fa85d58e016b414/ 287 KB
94 KB 137ms
91ms Script
text/javascript 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8fa85d58e016b414/cse_element__ja.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin01s16-in-f4.1e100.net

Software

sffe /

Resource Hash

9d3c12b97ece45f6079634b9086909b43c0f0aed4320f0630cf4b32baebb0d18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Wed, 12 Jun 2024 21:33:21 GMT
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 96200
x-xss-protection: 0
server: sffe

GET
H3 200 default+ja.css
www.google.com/cse/static/element/8fa85d58e016b414/ 41 KB
9 KB 118ms
74ms Stylesheet
text/css 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin01s16-in-f4.1e100.net

Software

sffe /

Resource Hash

a5402de70228d4bf5379b518225b702918f6ae277e9293f9d16334c2b1fa31e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Wed, 12 Jun 2024 21:33:21 GMT
link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 9068
x-xss-protection: 0
server: sffe

GET
H3 200 default.css
www.google.com/cse/static/style/look/v4/ 4 KB
1 KB 75ms
31ms Stylesheet
text/css 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v4/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=004990004422359256493:nnhwqqlx864

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin01s16-in-f4.1e100.net

Software

sffe /

Resource Hash

dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
age: 2493
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:54:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:04:28 GMT
last-modified: Wed, 17 Jun 2020 00:00:00 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=3000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 1345
x-xss-protection: 0
server: sffe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 294 KB
100 KB 59ms
58ms Script
application/javascript 2404:6800:4004:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:828::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1dafb5f4623dc5e204ebae274cb268814966c6ae01a2179b9f4f1965874dd5f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 101866
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 79ms
16ms Script
text/javascript 2404:6800:400a:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-124034031-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80e::200e Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
age: 6942
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:50:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 10:50:19 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 78ms
65ms Fetch
text/plain 2404:6800:400a:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-6NX4WBMERX&gtm=45je49p0v889024560za200&_p=1727700361447&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101747727&cid=1632996529.1727700362&ul=ja-jp&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1727700361&sct=1&seg=0&dl=https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fmirrorface-attack-against-japanese-organisations.html%3F%26web_view%3Dtrue&dt=MirrorFace%20Attack%20against%20Japanese%20Organisations%20-%20JPCERT%2FCC%20Eyes%20%7C%20JPCERT%20Coordination%20Center%20official%20Blog&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=737
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6NX4WBMERX
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:400a:80e::200e Osaka, Japan, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://blogs.jpcert.or.jp
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 button.856debeac157d9669cf51e73a08fbc93.js Show response
platform.twitter.com/js/ 8 KB
3 KB 3ms
3ms Script
application/javascript 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.856debeac157d9669cf51e73a08fbc93.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
etag: "fdf02dd038ed38dbf3c240d56262af0c+gzip"
access-control-allow-methods: GET
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
date: Mon, 30 Sep 2024 12:46:01 GMT
last-modified: Mon, 11 Dec 2023 17:19:47 GMT
vary: Accept-Encoding
x-served-by: cache-iad-kjyo7100074-IAD, cache-hnd18740-HND
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
tw-cdn: FT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2620
x-amz-server-side-encryption: AES256

GET
H2 200 tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame C3F8 0
0 3ms
1ms Document
text/html 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 12332
content-type: text/html; charset=utf-8
date: Mon, 30 Sep 2024 12:46:01 GMT
etag: "e29e65db7bf0a096587728e1faacfd9c+gzip"
last-modified: Mon, 11 Dec 2023 17:19:48 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kcgs7200168-IAD, cache-hnd18735-HND

GET
H2 200 tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
platform.twitter.com/widgets/ Frame 51F1 0
0 2ms
2ms Document
text/html 151.101.228.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2f70fb173b9000da126c79afe2098f02.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.228.157 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://blogs.jpcert.or.jp/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 12332
content-type: text/html; charset=utf-8
date: Mon, 30 Sep 2024 12:46:01 GMT
etag: "e29e65db7bf0a096587728e1faacfd9c+gzip"
last-modified: Mon, 11 Dec 2023 17:19:48 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kcgs7200168-IAD, cache-hnd18735-HND

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
291 B 109ms
100ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fmirrorface-attack-against-japanese-organisations.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1727700361745%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=3f4b798217fc84c96622be9692951352de550034

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-type: image/gif
strict-transport-security: max-age=631138519
x-transaction-id: fc9c1c1c62d600ea
cache-control: must-revalidate, max-age=600
x-connection-hash: 13ee811b03ad01029a5850d83c00fa44247e50b03b6bf0ea0b64f754e08b2227
x-response-time: 98
content-length: 43
date: Mon, 30 Sep 2024 12:46:01 GMT
last-modified: Mon, 30 Sep 2024 12:46:01 GMT
perf: 7402827104
vary: Origin
server: tsa_m

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
96 B 112ms
104ms Image
image/gif 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fmirrorface-attack-against-japanese-organisations.html%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1727700361746%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%222615f7e52b7e0%3A1702314776716%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=3f4b798217fc84c96622be9692951352de550034

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-type: image/gif
strict-transport-security: max-age=631138519
x-transaction-id: 199d16283d5e3b4e
cache-control: must-revalidate, max-age=600
x-connection-hash: 13ee811b03ad01029a5850d83c00fa44247e50b03b6bf0ea0b64f754e08b2227
x-response-time: 101
content-length: 43
date: Mon, 30 Sep 2024 12:46:01 GMT
last-modified: Mon, 30 Sep 2024 12:46:01 GMT
perf: 7402827104
vary: Origin
server: tsa_m

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
304 B 51ms
50ms XHR
text/plain 2404:6800:400a:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=894797075&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.jpcert.or.jp%2Fen%2F2024%2F07%2Fmirrorface-attack-against-japanese-organisations.html%3F%26web_view%3Dtrue&ul=ja-jp&de=UTF-8&dt=MirrorFace%20Attack%20against%20Japanese%20Organisations%20-%20JPCERT%2FCC%20Eyes%20%7C%20JPCERT%20Coordination%20Center%20official%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1607990895&gjid=10634196&cid=1632996529.1727700362&tid=UA-124034031-1&_gid=1471309214.1727700362&_r=1&gtm=457e49p0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&jsscut=1&z=723981488

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:400a:80e::200e Osaka, Japan, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://blogs.jpcert.or.jp/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://blogs.jpcert.or.jp
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H2 200 async-ads.js Show response
cse.google.com/adsense/search/ 146 KB
53 KB 62ms
60ms Script
text/javascript 2404:6800:4004:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/adsense/search/async-ads.js

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/8fa85d58e016b414/cse_element__ja.js?usqp=CAI%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:827::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d734e44be8afa8baca0c85be6689d1f534fc19554b35312e2c13beb06150fef6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

content-encoding: gzip
etag: "6805461700990520924"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 12:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 30 Sep 2024 12:46:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
link: <https://syndicatedsearch.goog>; rel="preconnect"
cache-control: private, max-age=3600
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
accept-ranges: bytes
x-xss-protection: 0
server: sffe

GET
H3 200 clear.png
www.google.com/cse/static/css/v2/ 1018 B
1 KB 12ms
12ms Image
image/png 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/css/v2/clear.png

Requested by

Host: www.google.com
URL: https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin01s16-in-f4.1e100.net

Software

sffe /

Resource Hash

329d1a750114920332eadc55c129957d9dbe5a1b25745e2f7e0ed4fad75e04cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.google.com/cse/static/element/8fa85d58e016b414/default+ja.css

Response headers

age: 195225
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Sun, 28 Sep 2025 06:32:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 28 Sep 2024 06:32:16 GMT
last-modified: Mon, 25 May 2020 08:30:00 GMT
content-type: image/png
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 1018
x-xss-protection: 0
server: sffe

GET
H3 200 branding.png
www.google.com/cse/static/images/1x/ja/ 1 KB
1 KB 10ms
10ms Image
image/png 172.217.25.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/cse/static/images/1x/ja/branding.png

Requested by

Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.25.164 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sin01s16-in-f4.1e100.net

Software

sffe /

Resource Hash

b0983545a358cc3907ff7ff53f7c075eff35e8ca3d1c5c54704470abc4624a29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

age: 265685
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
x-content-type-options: nosniff
expires: Sat, 27 Sep 2025 10:57:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 10:57:56 GMT
last-modified: Thu, 07 Dec 2023 21:00:00 GMT
content-type: image/png
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
content-length: 1249
x-xss-protection: 0
server: sffe

GET
H2 204 generate_204
clients1.google.com/ 0
117 B 233ms
62ms Image
text/plain 2404:6800:4004:80a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://clients1.google.com/generate_204
Requested by: Host: blogs.jpcert.or.jp
URL: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80a::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Mon, 30 Sep 2024 12:46:02 GMT
cross-origin-resource-policy: cross-origin

GET
H2 200 favicon.ico
blogs.jpcert.or.jp/en/common/images/ 5 KB
6 KB 5ms
4ms Other
image/vnd.microsoft.icon 52.198.153.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.jpcert.or.jp/en/common/images/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.198.153.39 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-198-153-39.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

c7f6f4acee58585774f7bb43bd5a95200029af8d32847f29fcf1126832d82753

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html?&web_view=true

Response headers

strict-transport-security: max-age=3600
etag: "fe6624b7972582fe71cd6779a97147c5"
x-amz-version-id: Qo1K29yIHuYGTcjE3QmsvNjsoa6Mp9Yy
age: 216106
expect-ct: enforce, max-age=3600
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 5558
x-xss-protection: 1; mode=block
date: Mon, 30 Sep 2024 12:46:02 GMT
content-type: image/vnd.microsoft.icon
last-modified: Fri, 09 Oct 2020 02:03:45 GMT
x-runtime: 0.020529

Verdicts & Comments Add Verdict or Comment

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.jpcert.or.jp/	1970-01-21 09:31:00	Name: _ga_6NX4WBMERX Value: GS1.1.1727700361.1.0.1727700361.0.0.0
.jpcert.or.jp/	1970-01-21 09:31:00	Name: _ga Value: GA1.3.1632996529.1727700362
.jpcert.or.jp/	1970-01-20 23:56:26	Name: _gid Value: GA1.3.1471309214.1727700362
.jpcert.or.jp/	1970-01-20 23:55:00	Name: _gat_gtag_UA_124034031_1 Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=3600
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogs.jpcert.or.jp
cdnjs.cloudflare.com
clients1.google.com
cse.google.com
movabletype.net
platform.twitter.com
pro.ranklet4.com
syndication.twitter.com
ws.jpcert.or.jp
www.google-analytics.com
www.google.com
www.googletagmanager.com
104.17.24.14
104.244.42.72
151.101.228.157
172.217.25.164
210.231.184.214
2404:6800:4004:80a::200e
2404:6800:4004:827::200e
2404:6800:4004:828::2008
2404:6800:400a:80e::200e
35.78.25.103
52.196.227.230
52.198.153.39
040b7d2bad999ab19ce77cb0816e33ff499f42f000948ce43477482ef0870e53
10de10394a37304a0c94242badee67380313edf5d99f963126c0660f7115315f
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
1dafb5f4623dc5e204ebae274cb268814966c6ae01a2179b9f4f1965874dd5f1
1fcf9d4554d76487710bf29c1ce350bdc068a59469c3ba2a2ea6842d4f343a9d
23e6d93452a4c0db3f01dfcdcef099dfe3e9861eb3b03ea07ae1878d63b7d412
23fd61c6a9f5a2c1d58d42eebce6f72a1e0838eafcd8adb349ee85b1024db128
261c7d35b8070f9e07d90aec18fe37b29b78e49cbbdb13c279efda50dc92cbfe
2ec9087635398a0a4f08808b2d5bd3af37542c290314c060303ee3a41e7af6bd
329d1a750114920332eadc55c129957d9dbe5a1b25745e2f7e0ed4fad75e04cd
36ba36d6118ad765aa17b49bcc2d3fc44379b1c8715cabc60bda192ad0a79261
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3eb59031e11a678d81f252f9bbde2c7485376af26fb50b2d5099497e8de378a3
3fe28539e1748678b784696a87f1ed41b2aa3bea2399c1f30d8f921769634107
426e16d014775c77916610f675f58880874c645817ed26d01873dde3466e6007
46e2a1c601fb504a72bfdca8785474711d40549df3a0f73cef2474e4f3c66476
541e7e2b59e866c63fbfd0d4144a3d21f7ed0c0bec77557555fef95d3d868040
62173c7f7a3f43f2beb1f3a35a68dbfc8738b3b0d00bdc6290427eaa1d33df16
6306901b0d07da0ebe3b88d092442106cf98919ba3669adabcc2d3f6e759cecc
64871e8b15628e5023849cfadc90ec6482233a8260fb39d32458e94ebfbc5de5
684476872d3b64b3fbb972c14b1d21d4bde8b6c8074a644f93e234764f542ffd
6a2fbbe670d3e049df7de0e20f3698882ed9783e47a010e1b0c2c746b919091c
6a52e408e0c5186de02719f1755dd12c48814f80a99580900213446abb2e593a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f7505af235b3dec440dedfbc35698ffd35372032e9c0122afc003636ea894b4
70d94eb165a7fbeb4e4b7a6287db82e9b0ad308579eaadc032d36e80eb88ba9e
7ecf5c4eac9ac965236717659e8dfb77a07e7d30b432fc1ca605df535d36e187
7fe1a58ea8b8fdfaca777d67aab3b8c3162591f5370294c693fbf6713b563bee
81bce6f5dca2c1af2a19e0b92f59a68bf3dd4a865e0d86f5212af7eafd97d0c2
830ae81a7374748dc123821adcb7c0548ba35d4f16b74c234aa8a0dba1729960
8f9b55020e7cc565c19802aadbb037ca8d79317b92c0969e1f58c70ec37501a0
8ff4087a3a8cd84f531cc004b828d38109d3010a17b2e2a41915c8907c85f9d5
90bfb0ff383c74405328fce0fcfa8544f0a8549f9d3d18c3245dd8fb54f6a65e
92f1bc2e6be6094ffa0bd7ba2538fb71e6aadfd481c2b762c35a4b5559380a6d
9d3c12b97ece45f6079634b9086909b43c0f0aed4320f0630cf4b32baebb0d18
a1621e130585831d259ddd60b724d8e04574f221a7c256b811f60800a92dcb92
a2e10042ac4f32ed3a8483d21cefc2a38f32fae538f56021d5b3138abd620383
a5402de70228d4bf5379b518225b702918f6ae277e9293f9d16334c2b1fa31e3
a6653a5760c7cea6cdad209d739f01c8436527a428fa218459716fab12ce37cf
a8063b32a2b02296dbcb861b81a209185ad876688835b12106bd04c7196342a5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0983545a358cc3907ff7ff53f7c075eff35e8ca3d1c5c54704470abc4624a29
b97d6ad69550a314a89563c1877d76d4e80a01a0d88c7083aa85c0f0d5b32e6b
bff0831e53ffe4da0fc58d076aafffae2e6f46b7210f7f2d08c2b88c53304fe8
c7f6f4acee58585774f7bb43bd5a95200029af8d32847f29fcf1126832d82753
d025d624352f8a6ceec63d1be3f7513b4874d370d224a3011620d20c03276e2e
d0496587eb0e1b42d3614c76d3e0a76290f7a5139940cc2cd8c195cbcab39b37
d0777e2e2c6a47608109aa789d1f8769aa6b972da30e0ffaf631a1fefbf31fd4
d734e44be8afa8baca0c85be6689d1f534fc19554b35312e2c13beb06150fef6
db202f6b1909fb514275f7d608e1497fa95e8ba8f850c8909b1927cf11f85e52
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e502f0bbfcb50ab822ce1f941eed85eb4628a4e301132e1dcb047f5b96a55900
eba8d7f3703d70c73f3403a2754b3b41c92e4aeaaabdbdd417585bfefd49eec3
f16e506333607b7cc9a7dfb8696f183a41be2d3e9937fc470108db718e20cd56
f28190ed8f8ff694cf05496cbd67f9f2093a0e9c8e5caf7d0deb5939bd2f37c7
ff861020b28433e34b45e616f29e4b82f124aad013b678a916d47274a3fa142d
fff8c4b16d509b3a3dfd540786931080018d74abd3190e7723cf6e914a93ce95

blogs.jpcert.or.jp Open in urlscan Pro 52.198.153.39 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

65 Requests

100 %HTTPS

33 %IPv6

8 Domains

12 Subdomains

12 IPs

4 Countries

4816 kBTransfer

5981 kBSize

4 Cookies

10 Outgoing links

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blogs.jpcert.or.jp Open in urlscan Pro
52.198.153.39 Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

100 %
HTTPS

33 %
IPv6

8
Domains

12
Subdomains

12
IPs

4
Countries

4816 kB
Transfer

5981 kB
Size

4
Cookies

65 HTTP transactions
0 data transactions