pentestlaboratories.com Open in urlscan Pro
192.0.78.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Submission: On June 01 via manual (June 1st 2021, 10:32:03 am UTC) from US

Summary HTTP 75 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 8 domains to perform 75 HTTP transactions. The main IP is 192.0.78.25, located in United States and belongs to AUTOMATTIC, US. The main domain is pentestlaboratories.com.
TLS certificate: Issued by R3 on May 29th 2021. Valid for: 3 months.

This is the only time pentestlaboratories.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
26	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
19	192.0.72.27 192.0.72.27	2635 (AUTOMATTIC) (AUTOMATTIC)
1 6	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
4	192.0.123.248 192.0.123.248	2635 (AUTOMATTIC) (AUTOMATTIC)
6	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	192.0.78.18 192.0.78.18	2635 (AUTOMATTIC) (AUTOMATTIC)
2	192.0.78.23 192.0.78.23	2635 (AUTOMATTIC) (AUTOMATTIC)
75	13

2 192.0.78.25 (United States)

ASN2635 (AUTOMATTIC, US)

pentestlaboratories.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 192.0.77.32 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 192.0.72.27 (United States)

ASN2635 (AUTOMATTIC, US)

pentestlaboratories.files.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:fa87:fffe::c000:4902 (Ireland) 1 redirects

ASN2635 (AUTOMATTIC, US)

2.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
1.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.123.248 (Los Angeles, United States)

ASN2635 (AUTOMATTIC, US)
PTR: polldaddy.com

polldaddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.0.76.3 (United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.18 (United States)

ASN2635 (AUTOMATTIC, US)

r-login.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.78.23 (United States)

ASN2635 (AUTOMATTIC, US)

public-api.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	wp.com s0.wp.com stats.wp.com widgets.wp.com pixel.wp.com	287 KB
22	wordpress.com pentestlaboratories.files.wordpress.com r-login.wordpress.com public-api.wordpress.com	581 KB
6	gravatar.com 1 redirects 2.gravatar.com 1.gravatar.com 0.gravatar.com	12 KB
5	gstatic.com fonts.gstatic.com	145 KB
4	polldaddy.com polldaddy.com	9 KB
4	googleapis.com fonts.googleapis.com	3 KB
2	pentestlaboratories.com pentestlaboratories.com	53 KB
1	facebook.com graph.facebook.com	648 B
75	8

	Domain	Requested by
23	s0.wp.com	pentestlaboratories.com widgets.wp.com public-api.wordpress.com
19	pentestlaboratories.files.wordpress.com	pentestlaboratories.com
5	pixel.wp.com	pentestlaboratories.com
5	fonts.gstatic.com	fonts.googleapis.com
4	polldaddy.com	pentestlaboratories.com polldaddy.com
4	fonts.googleapis.com	s0.wp.com pentestlaboratories.com
3	widgets.wp.com	pentestlaboratories.com s0.wp.com widgets.wp.com
3	0.gravatar.com	pentestlaboratories.com 0.gravatar.com
2	public-api.wordpress.com	s0.wp.com public-api.wordpress.com
2	2.gravatar.com	1 redirects pentestlaboratories.com
2	pentestlaboratories.com	pentestlaboratories.com
1	r-login.wordpress.com	pentestlaboratories.com
1	graph.facebook.com	s0.wp.com
1	stats.wp.com	pentestlaboratories.com
1	1.gravatar.com	pentestlaboratories.com
75	15

This site contains links to these domains. Also see Links.

Domain
github.com
twitter.com
gist.github.com
gravatar.com
akismet.com
www.youtube.com
www.instagram.com
www.linkedin.com
www.facebook.com
discord.gg
wordpress.com
pentestlaboratories.wordpress.com
wp.me
en.wordpress.com
subscribe.wordpress.com

Subject Issuer	Validity	Valid
tls.automattic.com R3	`2021-05-29` - `2021-08-27`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-03` - `2021-07-26`	3 months	crt.sh
*.files.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-12-21` - `2022-01-21`	a year	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.polldaddy.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh
*.wordpress.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-12` - `2022-11-14`	2 years	crt.sh

This page contains 5 frames:

Primary Page: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Frame ID: 609CE844EBB9DDA526FEC019A5C7C14D
Requests: 69 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20210413
Frame ID: CFC10EB10138F3F7CA36995AFD2B9AAB
Requests: 3 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFib3JhdG9yaWVzLmNvbQ%3D%3D&wpcomid=151987412&time=1622543505
Frame ID: 690B9C11FEA613AA22643174E26F0777
Requests: 1 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: E7DAD01EFA4AE7AF34C6CB2EB4268B40
Requests: 3 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/index.html?ver=20210413
Frame ID: C4ADE066CF29F64716D69F5C6E1AD1C4
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
html /<link[^>]+s\d+\.wp\.com/i
script /\/wp-(?:content|includes)\//i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

75
Requests

100 %
HTTPS

42 %
IPv6

8
Domains

15
Subdomains

13
IPs

3
Countries

1128 kB
Transfer

2130 kB
Size

0
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/countercept/AMSIDetection
Title: AMSIDetection

Search URL Search Domain Scan URL

URL: https://github.com/hasherezade/pe-sieve
Title: PE-Sieve

Search URL Search Domain Scan URL

URL: https://github.com/forrest-orr/moneta
Title: Moneta

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation
Title: Matt Graeber

Search URL Search Domain Scan URL

URL: https://gist.github.com/mattifestation/e179218d88b5f100b0edecdec453d9be
Title: AMSIScriptContentRetrieval

Search URL Search Domain Scan URL

URL: https://twitter.com/eric_conrad
Title: Eric Conrad

Search URL Search Domain Scan URL

URL: https://github.com/sans-blue-team/DeepBlueCLI
Title: DeepBlueCLI

Search URL Search Domain Scan URL

URL: https://gravatar.com/site/signup/
Title:

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://twitter.com/pentestlabltd
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/c/PentestLaboratories
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/pentestlaboratories/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/26271095
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/pentestlaboratory/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://discord.gg/rR6FJBH
Title: Discord

Search URL Search Domain Scan URL

URL: https://wordpress.com/?ref=footer_custom_powered
Title: Website Powered by WordPress.com

Search URL Search Domain Scan URL

URL: https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fr-login.wordpress.com%2Fremote-login.php%3Faction%3Dlink%26back%3Dhttps%253A%252F%252Fpentestlaboratories.com%252F2021%252F06%252F01%252Fthreat-hunting-amsi-bypasses%252F
Title: Log in now.

Search URL Search Domain Scan URL

URL: https://pentestlaboratories.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fpentestlaboratories.wordpress.com%2F2021%2F06%2F01%2Fthreat-hunting-amsi-bypasses%2F
Title: Customize

Search URL Search Domain Scan URL

URL: https://wordpress.com/start/
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wp.me/pahIRS-N4
Title: Copy shortlink

Search URL Search Domain Scan URL

URL: http://en.wordpress.com/abuse/
Title: Report this content

Search URL Search Domain Scan URL

URL: https://subscribe.wordpress.com/
Title: Manage subscriptions

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://2.gravatar.com/avatar/e9658441049a79823212b379affee0c4?s=48&d=https%3A%2F%2F2.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G HTTP 302
https://2.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48

75 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/ 182 KB
51 KB 419ms
372ms Document
text/html 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

943b942380a519d6a9c14a7f040e3db6a6112c3dcdf55d17a9b5ca859205158c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: pentestlaboratories.com
:scheme: https
:path: /2021/06/01/threat-hunting-amsi-bypasses/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Tue, 01 Jun 2021 10:31:45 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
host-header: WordPress.com
x-pingback: https://pentestlaboratories.com/xmlrpc.php
link: <https://wp.me/pahIRS-N4>; rel=shortlink
content-encoding: gzip
x-ac: 3.vie _dca

GET
H2 200 webfont.js Show response
s0.wp.com/wp-content/plugins/custom-fonts/js/ 12 KB
5 KB 55ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5bffef57-30cd"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 01:51:39 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
781 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/plugins/custom-fonts/js/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a5bc80201d208f16bc81a2fafacab9b99503d04afe96b8f2524e9ae6768ccb04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 10:31:45 GMT
server: ESF
date: Tue, 01 Jun 2021 10:31:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 01 Jun 2021 10:31:45 GMT

GET
H2 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.gstatic.com/s/ubuntu/v15/ 28 KB
28 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

045469f2d577c2ad73219bbd713640bcb4a4f9a46cecc6c0df0e66338646b27f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 30 May 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:03:43 GMT
server: sffe
age: 174487
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28968
x-xss-protection: 0
expires: Mon, 30 May 2022 10:03:38 GMT

GET
H2 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v15/ 33 KB
34 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4f4524f7e1a87079bc50a64681f880ccf3e6f5db1ec5fc27949377532a3881da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 00:03:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:02:57 GMT
server: sffe
age: 37669
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34260
x-xss-protection: 0
expires: Wed, 01 Jun 2022 00:03:56 GMT

GET
H2 200 4iCu6KVjbNBYlgoKej70l0k.woff2
fonts.gstatic.com/s/ubuntu/v15/ 35 KB
35 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCu6KVjbNBYlgoKej70l0k.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4f396a8aaf313e0798f971317151c0716b476f90b8fe539280a094efd420157

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 31 May 2021 04:15:09 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:02:33 GMT
server: sffe
age: 108996
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35832
x-xss-protection: 0
expires: Tue, 31 May 2022 04:15:09 GMT

GET
H2 200 4iCp6KVjbNBYlgoKejZPslyPN4E.woff2
fonts.gstatic.com/s/ubuntu/v15/ 29 KB
30 KB 11ms
10ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v15/4iCp6KVjbNBYlgoKejZPslyPN4E.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Ubuntu:b%7CUbuntu:r,i,b,bi&subset=latin,latin-ext,latin,latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aaa5c804f7a331ebdac8988c462bfc09ab5fb7d80a699da7ed1d1f3683b6bbf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 01:03:12 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:03:17 GMT
server: sffe
age: 34113
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30092
x-xss-protection: 0
expires: Wed, 01 Jun 2022 01:03:12 GMT

GET
H2 200 /
s0.wp.com/_static/ 430 KB
85 KB 20ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJydkVtSwzAMRTeEIwItTD8Y1mI7wqj1a/ygk92jxFBSWgLDT8ZXuUe2dOEYhQ6+oC/gqoi2GvIZjlEHJ7Iji+M31emcb+A6ZumAGfZYotQHMasL+6fXVJYKk+E/CeGtv+223QZUJTuAsmFuoJJMI+QyWvxDo5la3C/HUIswiYb/tkiykDf5F1yHD+yu4yl6GCiXU1FcZxdbm+bnuouyTA6HA0m06Ni2hrVUlIoJcxb8dVSdKK8MrobE1NS6xQNsPK80lMCHQkzn02Gtp0GPqdmvHi/Y9kyIVYEJSfofNryw8VY8kNfNKebpV9dDg8HC0QVN0or2oqVYnycITo/TD/5MiBcrKa2hCTl3w0cz7/ZLTtCze+of+t3m7n77uNu/Ay+ZUBo=?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 5ad4f0148f584616f5022ad1cf3f27801eb12f02016d17ded07cef116e5f8887

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Wed, 05 May 2021 16:06:54 GMT
server: nginx
etag: W/"6092c29e-6b6cc"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 06 May 2022 02:10:53 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 9 KB
876 B 37ms
22ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Sans%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3e28d3fce7981c08fdbca297fba1501e9505ab99ebdd3fc0899a707f696308f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 10:12:47 GMT
server: ESF
date: Tue, 01 Jun 2021 10:31:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 01 Jun 2021 10:31:45 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 8 KB
791 B 30ms
16ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Serif%3A400%2C700%2C400italic%2C700italic&subset=latin%2Clatin-ext

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

261f6d41152c23901b04f84482ab4d64a653d6727d0b0be520467961bf73d60e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 10:31:45 GMT
server: ESF
date: Tue, 01 Jun 2021 10:31:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 01 Jun 2021 10:31:45 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 390 B
313 B 29ms
14ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Droid+Sans+Mono

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e1bfde496852baa24aa274ab7345c8d31119f15d63ec62a5ed2448b8dfbff3c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 01 Jun 2021 09:07:30 GMT
server: ESF
date: Tue, 01 Jun 2021 10:31:45 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 01 Jun 2021 10:31:45 GMT

GET
H2 200 style-wpcom.css
s0.wp.com/wp-content/themes/pub/goran/inc/ 5 KB
1 KB 44ms
43ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/themes/pub/goran/inc/style-wpcom.css?m=1453284068h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 75e485d4939193b87d2c1fcb13b8a2c4a6e74efd10363dbf6bd462b0a8b65467

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5bffef80-16d8"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Thu, 05 May 2022 19:38:14 GMT

GET
H2 200 /
s0.wp.com/_static/ 29 KB
11 KB 45ms
44ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxti0EKgCAQAD+ULUaJl+gtJqbG6opr9P3o0CHqNAzMwFmEpdxcbpAOUfDwMTMU4iY2NLECB1Nj9g97y9zB/8Vko0GB5Oktn6kFlxxDGMEjrQbvYEmzVHIclNZy2i9lFDfR?cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b70891fc93d3d70dd404dc552206fef8430a1cf1adf5d9fdbec73c4fc712ca8e

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Thu, 25 Feb 2021 16:01:19 GMT
server: nginx
etag: W/"6037c9cf-72b3"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 25 Feb 2022 16:01:25 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 132 KB
41 KB 55ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyFzUEKwkAMheELmQ5DocWFeJZaY8kwyYxJBu3traBQV67e4v/ghUeFuYijeEgWajFnNJsW7JIdwm/lcqGM0Ax1A+JAcitfRzLndkV7w3RvqOtnOib5i4Bp0clxj3fPmh2qlue6tTOf4hDHPvbDeEwvhOVG7A==
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 12b21a2d3fde07cf06583fbad384ba1bd37fb39bd1e4c2f208d6be41e3b19dd8

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 21:48:08 GMT
server: nginx
etag: W/"60663f98-20f0b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 01 Apr 2022 21:49:11 GMT

GET
H2 200 style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ 19 KB
3 KB 45ms
44ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1530132353h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5bffef5b-5e1f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 01:51:38 GMT

GET
H2 200 amsi-bypass-memory-patching-amsi-patch-detection-yara.png
pentestlaboratories.files.wordpress.com/2021/05/ 8 KB
8 KB 74ms
18ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-memory-patching-amsi-patch-detection-yara.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

810614de7cadb90bbd76f5742707a504a7ce884ce01c1d1021ba48e9f001da32

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 20:42:06 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 7766
expires: Fri, 02 Jul 2021 06:32:45 GMT

GET
H2 200 amsi-bypass-memory-patching-amsi-patch-detection-memory-tampering-1.png
pentestlaboratories.files.wordpress.com/2021/05/ 18 KB
18 KB 74ms
18ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-memory-patching-amsi-patch-detection-memory-tampering-1.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f648696e64e46c7478724780a9d9d3bf5a18d72a3555a6417c232f0f032a8a5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 23 May 2021 15:12:03 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 18726
expires: Mon, 05 Jul 2021 14:00:16 GMT

GET
H2 200 amsi-bypass-hooking-detection-sysmon.png
pentestlaboratories.files.wordpress.com/2021/05/ 89 KB
89 KB 74ms
18ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-hooking-detection-sysmon.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c987e56e0bf8e65d48229768927f8776cbc2e500dcd9924603617365516fd3d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 23 May 2021 21:12:53 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 90945
access-control-allow-credentials: true
expires: Wed, 30 Jun 2021 12:01:51 GMT

GET
H2 200 amsi-bypass-hooking-detection-pe-sieve.png
pentestlaboratories.files.wordpress.com/2021/05/ 27 KB
27 KB 74ms
18ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-hooking-detection-pe-sieve.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

43fe33efd7b9aeb21d66eaa40be4db4bbfe40ac9fe37c856472fb312ba81ef63

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 23 May 2021 17:12:14 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 27863
expires: Fri, 25 Jun 2021 09:00:26 GMT

GET
H2 200 amsi-bypass-hooking-detection-pe-sieve-dump-dll.png
pentestlaboratories.files.wordpress.com/2021/05/ 22 KB
22 KB 97ms
42ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-hooking-detection-pe-sieve-dump-dll.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3bb9a06c0996de23b64c4b3c2982a0fea5553e388c2f8024def04df65bb66b4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 23 May 2021 19:35:37 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 22170
expires: Tue, 06 Jul 2021 15:34:47 GMT

GET
H2 200 amsi-bypass-hooking-detection-ida.png
pentestlaboratories.files.wordpress.com/2021/05/ 28 KB
28 KB 97ms
42ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-hooking-detection-ida.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d5fd2abdea58c90fb96bc21e68318af1eeb99bb53db5bcccb0438ad29ddfd421

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 23 May 2021 19:41:13 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 28985
access-control-allow-credentials: true
expires: Thu, 24 Jun 2021 14:00:06 GMT

GET
H2 200 amsi-bypass-hooking-detection-moneta.png
pentestlaboratories.files.wordpress.com/2021/05/ 52 KB
53 KB 41ms
40ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-hooking-detection-moneta.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d0664ba530cba82fbf718324ef0284950f77927d3b6538c920957f0976bcaed6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 07:15:40 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 53727
expires: Tue, 06 Jul 2021 21:23:45 GMT

GET
H2 200 amsi-bypass-registry-key-modification-sysmon.png
pentestlaboratories.files.wordpress.com/2021/05/ 16 KB
16 KB 45ms
44ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-registry-key-modification-sysmon.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

3649e67c6a63061b530e7e8ee7b4d3c850fa6a88f4d0f3929be0a377fb5b4c41

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 09:50:58 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 16363
expires: Thu, 24 Jun 2021 18:36:19 GMT

GET
H2 200 amsi-bypass-base64-encoding-logman.png
pentestlaboratories.files.wordpress.com/2021/05/ 9 KB
9 KB 45ms
44ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-base64-encoding-logman.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2fba87fbe65763ca1e4026686befd9c869321bc95803a270c2a5d6c500534e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 20:36:18 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 9045
expires: Thu, 24 Jun 2021 17:05:21 GMT

GET
H2 200 amsi-bypass-base64-powershell-console.png
pentestlaboratories.files.wordpress.com/2021/05/ 13 KB
13 KB 46ms
44ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-base64-powershell-console.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

07e12d37545f79300fc9746e78200ef598de94548d1304e7897445b1901a2daa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 20:42:27 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 12867
expires: Fri, 25 Jun 2021 05:20:18 GMT

GET
H2 200 amsi-bypass-base64-encoding-detection.png
pentestlaboratories.files.wordpress.com/2021/05/ 14 KB
14 KB 46ms
44ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-base64-encoding-detection.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

eb3fea583d5f148b0c645dcdd7f35504abc085e9cfabc4cb1902f9611779bf07

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 20:45:09 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 14222
expires: Mon, 05 Jul 2021 17:00:54 GMT

GET
H2 200 amsi-bypass-base64-encoding-detection-script-content.png
pentestlaboratories.files.wordpress.com/2021/05/ 16 KB
16 KB 46ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-base64-encoding-detection-script-content.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5051802b58b6894f351acdd43360a21488da683209c11844b0f7441df1a1f5ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 23:03:39 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 16536
expires: Tue, 29 Jun 2021 16:45:25 GMT

GET
H2 200 amsi-bypass-base64-decoded-amsi-flags.png
pentestlaboratories.files.wordpress.com/2021/05/ 30 KB
30 KB 46ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/amsi-bypass-base64-decoded-amsi-flags.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d2eb21a830fc166171fdc5fb7e3625520588456966d6a470d7b03a3690987d70

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 20:47:05 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 30376
expires: Tue, 22 Jun 2021 09:02:01 GMT

GET
H2 200 powershell-script-block-logging.png
pentestlaboratories.files.wordpress.com/2021/05/ 27 KB
27 KB 46ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/powershell-script-block-logging.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fed11b98ab14755ff5015f63b0546dd4d644b738858555f525620a20cd16a2a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 May 2021 23:45:51 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 27339
expires: Sun, 27 Jun 2021 10:36:17 GMT

GET
H2 200 powershell-operational-logs-script-block-logging.png
pentestlaboratories.files.wordpress.com/2021/05/ 41 KB
41 KB 46ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/powershell-operational-logs-script-block-logging.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1aa88657bf87ae1676ce37f736eab2fbb82caa1a3631e36ebcb41aa484dae9de

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 00:47:26 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 42215
access-control-allow-credentials: true
expires: Fri, 02 Jul 2021 02:56:12 GMT

GET
H2 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ 14 KB
5 KB 21ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1612197847h&ver=5.7.2
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"60182fe3-3795"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 13 May 2022 14:50:40 GMT

GET
H2 200 global-print.css
s0.wp.com/wp-content/mu-plugins/global-print/ 5 KB
2 KB 20ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/global-print/global-print.css?m=1465851035h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5c066eac-1f6c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 01:51:39 GMT

GET
H2 200 forcing-an-error-variables-script-block-logging.png
pentestlaboratories.files.wordpress.com/2021/05/ 7 KB
7 KB 46ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/forcing-an-error-variables-script-block-logging.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b99c17d3ad46b558907c6b7d136f43a7f10daacbb3972f68c347dad13cb2e654

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 01:03:29 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 6830
expires: Tue, 06 Jul 2021 16:43:30 GMT

GET
H2 200 forcing-an-error-null-script-block-logging.png
pentestlaboratories.files.wordpress.com/2021/05/ 99 KB
99 KB 47ms
45ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/forcing-an-error-null-script-block-logging.png?w=1024

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1d48bbb23e6a6408c0629a336159147380418de969c0687d636d703e8b35abd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 01:09:05 GMT
server: nginx
vary: Accept, Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 0_imageresize
accept-ranges: bytes
content-length: 101452
access-control-allow-credentials: true
expires: Thu, 01 Jul 2021 01:53:01 GMT

GET
H2 200 deepbluecli-powershell-script-block-logging-base64.png
pentestlaboratories.files.wordpress.com/2021/05/ 34 KB
34 KB 47ms
46ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/deepbluecli-powershell-script-block-logging-base64.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

c9285c4c652d4650594b6468a37df94313bbc1fbcfb22dfe7e05c0f18e0cf82c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 07:41:32 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 34409
expires: Tue, 22 Jun 2021 03:56:07 GMT

GET
H2 200 forcing-an-error-deepblue.png
pentestlaboratories.files.wordpress.com/2021/05/ 26 KB
26 KB 47ms
46ms Image
image/png 192.0.72.27
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pentestlaboratories.files.wordpress.com/2021/05/forcing-an-error-deepblue.png

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.72.27 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

fc1b2b1eaf819b0406a9885edc7cc985c6cbd599e90f4e41da81795acfb19578

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 27 np
date: Tue, 01 Jun 2021 10:31:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 May 2021 19:55:47 GMT
server: nginx
accept-ranges: bytes
vary: Origin
content-type: image/png
access-control-allow-origin: https://pentestlaboratories.wordpress.com
x-orig-src: 01_mogdir
access-control-allow-credentials: true
content-length: 26712
expires: Sat, 03 Jul 2021 02:13:45 GMT

GET
H2

200

ad516503a11cd5ca435acc9bb6523536
2.gravatar.com/avatar/
Redirect Chain

https://2.gravatar.com/avatar/e9658441049a79823212b379affee0c4?s=48&d=https%3A%2F%2F2.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G
https://2.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48

1009 B
1 KB

7ms
6ms

Image
image/png

2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://2.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 6bf8b2cd55ee25d796364a66508ef6179389466174a439eba13069d8b233f39d

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 01 Jun 2021 10:31:45 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ad516503a11cd5ca435acc9bb6523536.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48>; rel="canonical"
content-length: 1009
expires: Tue, 01 Jun 2021 10:36:45 GMT

Redirect headers

x-nc: HIT hhn 2
date: Tue, 01 Jun 2021 10:31:45 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: text/html; charset=utf-8
location: https://2.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=48
cache-control: max-age=300
link: <https://www.gravatar.com/avatar/e9658441049a79823212b379affee0c4?s=48&d=https%3A%2F%2F2.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D48&r=G>; rel="canonical"
content-length: 0
expires: Tue, 01 Jun 2021 10:36:45 GMT

GET
H2 200 ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ 556 B
737 B 9ms
6ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ae82e42491a7de3c5d3df779e9600e5191708025e8c46102ccfa7026df735d64

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 01 Jun 2021 10:31:45 GMT
last-modified: Sat, 01 Mar 2008 02:44:06 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ad516503a11cd5ca435acc9bb6523536.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25>; rel="canonical"
content-length: 556
expires: Tue, 01 Jun 2021 10:36:45 GMT

GET
H2 200 gprofiles.js Show response
0.gravatar.com/js/ 23 KB
7 KB 19ms
5ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/js/gprofiles.js?ver=202122y
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Thu, 02 Apr 2020 15:50:36 GMT
server: nginx
etag: W/"5e8609cc-5dea"
content-type: application/javascript
cache-control: max-age=604800
expires: Tue, 08 Jun 2021 10:31:45 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 868 B
506 B 18ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240h
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5ffc31a9-465"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Tue, 11 Jan 2022 11:08:29 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 42 KB
11 KB 24ms
17ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/jquery/jquery.autoresize.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1573483029j
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Mon, 11 Nov 2019 14:37:22 GMT
server: nginx
etag: W/"5dc97222-a830"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Wed, 10 Nov 2021 14:37:27 GMT

GET
H2 200 loading.gif
s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/ 2 KB
3 KB 20ms
18ms Image
image/gif 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/wp-content/mu-plugins/post-flair/sharing/images/loading.gif
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
x-ac: 4.vie _dca
last-modified: Thu, 29 Nov 2018 13:53:33 GMT
server: nginx
etag: "5bffef5d-9e2"
access-control-allow-methods: GET, HEAD
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 2530
expires: Sat, 23 Oct 2021 01:52:19 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 34 KB
12 KB 24ms
17ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1i+uzCtJrMjITM/IAeKS1CJMEWP94uSizIISoOIM5/yiVL2sYh19yo1yKioFmheckVhUQE0TA/LLU4uCM1JzcqhpamRiLlXNiwAbZ59ra2hmaGpibmZpbJQFALaEoUs=
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 96a175a0dee54d0e9c857ca3505da6bba6f4e3e187a9f53ebd7fd1d2068ab084

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Thu, 11 Mar 2021 15:37:11 GMT
server: nginx
etag: W/"604a3927-8946"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Wed, 01 Jun 2022 10:28:55 GMT

GET
H2 200 jetpack-carousel.css
s0.wp.com/wp-content/mu-plugins/carousel/ 19 KB
4 KB 24ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/carousel/jetpack-carousel.css?m=1621851244h&cssminify=yes
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: ea4e511204fb4791ddf01acb0ae3d3030e7f359f81f6cb8a321310e91c266546

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"60ab7c78-5843"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Tue, 24 May 2022 10:14:21 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ 141 KB
39 KB 26ms
20ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyNkltSwzAMRTeEo6YUhh+GpTCOrSZK/KplN5TV4zYUSNsJ/bIs36OrkQxjEMq7hC5Bz6BxTwrDR9XzA8yf+l3GePg+KnJ7wvFfWY8pSDWIiEyfeCm3WQSTW3IMhgZkKFDGTjptMC6Ilbe2pMQE9Ue6AR4pLDlcQbPEJfhLNcargWFd1auqBk2cJnjKF7rtUuOvJpY6tMUn5AZQkzsyPFAoejeIrVeZxZZ+KHLKZD3vK2Iwh8qSWyjd+ihPtZ3cUysT+bvUp2BhVlIXW9HICFZywlgikWJZJN9quFzRNqhv9fp3ATL6zGjg/CnOiaVGBmKLSTxWK3gvnrD10d7hIcZQxnhxLdybfa2f1/XLU73ebPovOWUcgQ==
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: d344ad7b632a91201b85b7a93b210cc37f0f0f409a55a02c8c5e876b209cadc0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
last-modified: Mon, 24 May 2021 10:14:16 GMT
server: nginx
etag: W/"60ab7c78-235e6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Wed, 25 May 2022 07:36:27 GMT

GET
H2 200 rating.js Show response
polldaddy.com/js/rating/ 15 KB
4 KB 526ms
171ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Tue, 18 Feb 2020 17:20:26 GMT
server: nginx
etag: W/"5e4c1cda-3b42"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
expires: Thu, 01 Jul 2021 10:31:46 GMT

GET
H2 200 sharing.js Show response
s0.wp.com/wp-content/mu-plugins/post-flair/sharing/ 15 KB
4 KB 33ms
27ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1611055338h
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 1127fb86a27e063f7c16f71e8c9a3c6d087dc02964718b664a0c3dd8525d2567

Request headers

Origin: https://pentestlaboratories.com
Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"6006c0fb-5a9e"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Wed, 19 Jan 2022 11:22:42 GMT

GET
H3-29 200 6NUO8FuJNQ2MbkrZ5-J8lKFrp7pRef2r.woff2
fonts.gstatic.com/s/droidsansmono/v14/ 18 KB
18 KB 16ms
15ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/droidsansmono/v14/6NUO8FuJNQ2MbkrZ5-J8lKFrp7pRef2r.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans+Mono

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2707e0c95ef9e6fcea39cb6c17fb6cf2c630668c61b92b1c02870dfc18bfe08f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://pentestlaboratories.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 28 May 2021 04:00:06 GMT
x-content-type-options: nosniff
last-modified: Tue, 01 Sep 2020 03:52:28 GMT
server: sffe
age: 369099
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18440
x-xss-protection: 0
expires: Sat, 28 May 2022 04:00:06 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c

Request headers

Origin: https://pentestlaboratories.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Origin: https://pentestlaboratories.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 05914b956e9d0107351bca1ace8c4288c28c331338dc746b93f70bbe058502cf

Request headers

Origin: https://pentestlaboratories.com
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 w.js Show response
stats.wp.com/ 10 KB
4 KB 60ms
17ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/w.js?61
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 2b787dd1927b1cd247687f620670aa7b497a075bd5a418721b59fa5fb912ed55

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5fff0d1e-28ca"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Fri, 04 Mar 2022 22:24:13 GMT

GET
H2 200 bilmur.min.js Show response
pentestlaboratories.com/wp-content/js/ 4 KB
2 KB 140ms
130ms Script
application/javascript 192.0.78.25
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://pentestlaboratories.com/wp-content/js/bilmur.min.js?m=202122

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

7ddaad7c329d4d1405914ebfd87e94f8876d14ffd8a665fee7be24f087c98e4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:path: /wp-content/js/bilmur.min.js?m=202122
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: pentestlaboratories.com
referer: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
server: nginx
etag: W/"609b0669-10e1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
date: Tue, 01 Jun 2021 10:31:45 GMT
x-ac: 3.vie _dca
expires: Wed, 01 Jun 2022 10:31:45 GMT

GET
H2 200 shCore.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 5 KB
1 KB 18ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shCore.css?ver=3.0.9b
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5bffef57-1995"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 02:08:05 GMT

GET
H2 200 shThemeDefault.css
s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/ 2 KB
513 B 18ms
18ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/plugins/syntaxhighlighter/syntaxhighlighter3/styles/shThemeDefault.css?m=1363304414h&ver=3.0.9b
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:45 GMT
content-encoding: gzip
server: nginx
etag: W/"5bffef66-b3d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 02:08:05 GMT

GET
H2 200 rate.php Show response
polldaddy.com/ratings/ 1 KB
449 B 174ms
174ms Script
application/javascript 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://polldaddy.com/ratings/rate.php?cmd=get&id=8796967&uid=wp-post-3042&item_id=_post_3042
Requested by: Host: polldaddy.com
URL: https://polldaddy.com/js/rating/rating.js?ver=wpcom
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 43ce0993233b47e22f0301e3ab3e2d369e497d42f002e4e2729388e50fa50324

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
server: nginx
content-type: application/javascript
vary: Accept-Encoding
content-language: en

GET
H2 200 master.html Show response
widgets.wp.com/likes/ Frame CFC1 3 KB
1 KB 19ms
18ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=20210413
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cc74ed96b7cded3057097292949692d7a212bcadd50a213a9ad78ddd55ba81e6

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=20210413
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlaboratories.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://pentestlaboratories.com/

Response headers

server: nginx
date: Tue, 01 Jun 2021 10:31:46 GMT
content-type: text/html
last-modified: Wed, 14 Apr 2021 02:01:40 GMT
vary: Accept-Encoding
etag: W/"60764d04-ac0"
content-encoding: gzip
x-ac: 4.vie _dca
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
timing-allow-origin: *
x-nc: HIT vie 2

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 19ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.38467426511778413
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 19ms
18ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?blog=151987412&v=wpcom&tz=1&user_id=0&post=3042&subd=pentestlaboratories&host=pentestlaboratories.com&ref=&rand=0.8692965491113731
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 20ms
19ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29%2BSmw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8%2FMkNtblkvY1dSTkM3aVd2MFI1fkYvN1ZlUFsxemt6UFBZPVEmRXp1WkpaV1JKSmQzYm1dSGxoTTZmTUVqYnRJUEwlMjhTS21pSUN1R2dRQnxINVp8JTJfYkFBakZJQ1k5NzdBd2d1d2FjTEYuM1I0ODdBWDl2cE5QJVRbWGJqa3NRfjI9fGJFcFY%2FWFtCWzh0Lj9UU1ptMXUuOFRRcSwvL2tMOF1fUFF%2BVmZWUitTa1c9bVQ0NEtCUiVscjA0VXlIN0hbOCVKZnBObU5aLFdXdmZMJj9jc1RIYmtaUzlnSE5QZDk9&v=wpcom-no-pv&rand=0.9800809948191898
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 hovercard.min.css
0.gravatar.com/dist/css/ 8 KB
2 KB 6ms
5ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/hovercard.min.css?ver=202122y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202122y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 15:57:10 GMT
server: nginx
etag: W/"5fac09d6-1e86"
content-type: text/css
cache-control: max-age=604800
expires: Tue, 08 Jun 2021 10:31:46 GMT

GET
H2 200 services.min.css
0.gravatar.com/dist/css/ 3 KB
587 B 6ms
6ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://0.gravatar.com/dist/css/services.min.css?ver=202122y
Requested by: Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202122y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Thu, 22 Mar 2018 09:46:04 GMT
server: nginx
etag: W/"5ab37b5c-a54"
content-type: text/css
cache-control: max-age=604800
expires: Tue, 08 Jun 2021 10:31:46 GMT

GET
H2 200 / Show response
graph.facebook.com/ 244 B
648 B 51ms
37ms Script
text/javascript 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fpentestlaboratories.com%2F2021%2F06%2F01%2Fthreat-hunting-amsi-bypasses%2F

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/post-flair/sharing/sharing.js?m=1611055338h

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1f640ab8c9d79312bcbe429ae5e2090eb6de2b1bed61f3f8729e1461731155c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1003880980
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 184
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: D4A9dIZJxydu17Yn8r6mi7sviCztLMbGVUU3zb3pipwBuClFr355wGb1ZL3D4PzEfh1N9RuJ9JhI8D7MvmoPkA==
x-fb-trace-id: BXWA4mPUTTS
date: Tue, 01 Jun 2021 10:31:46 GMT
vary: Origin, Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: A8lZuSAb_1a9ezmhDENzW26
cache-control: no-store
facebook-api-version: v3.3
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 17ms
17ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.1764031691790351
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 remote-login.php Show response
r-login.wordpress.com/ Frame 690B 133 B
314 B 208ms
168ms Document
text/html 192.0.78.18
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFib3JhdG9yaWVzLmNvbQ%3D%3D&wpcomid=151987412&time=1622543505

Requested by

Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.18 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

95fddf05b0a4211a795d0d4e3774dc4a865e624f845917dc5add7f4b45893edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: r-login.wordpress.com
:scheme: https
:path: /remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9wZW50ZXN0bGFib3JhdG9yaWVzLmNvbQ%3D%3D&wpcomid=151987412&time=1622543505
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlaboratories.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://pentestlaboratories.com/

Response headers

server: nginx
date: Tue, 01 Jun 2021 10:31:46 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding Cookie
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: gzip
x-ac: 2.vie _dfw
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
s0.wp.com/_static/ Frame CFC1 22 KB
5 KB 19ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/rlt-proxy.js?m=20210413
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20210413
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88

Request headers

Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 21:48:08 GMT
server: nginx
etag: W/"60663f98-56cb"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Thu, 14 Apr 2022 02:02:09 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame CFC1 93 KB
25 KB 20ms
19ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/jed/jed.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20210317
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20210413
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: cf6c56fe71c3a0a2ee4e9e6e1760949e1fc2fe68ed6edee89d72c2156b3a7cd1

Request headers

Referer: https://widgets.wp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Mon, 12 Apr 2021 17:54:33 GMT
server: nginx
etag: W/"60748959-172b5"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Tue, 12 Apr 2022 18:38:58 GMT

GET
H2 200 / Show response
public-api.wordpress.com/wp-admin/rest-proxy/ Frame E7DA 8 KB
3 KB 172ms
130ms Document
text/html 192.0.78.23
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/wp-admin/rest-proxy/

Requested by

Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/jed/jed.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20210317

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.23 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

13c6db1ac0497928444e50aac43b5213354270c74537966202618efc12778122

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: public-api.wordpress.com
:scheme: https
:path: /wp-admin/rest-proxy/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://widgets.wp.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://widgets.wp.com/

Response headers

server: nginx
date: Tue, 01 Jun 2021 10:31:46 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
p3p: CP="CAO PSA OUR"
set-cookie: wp_api=+; expires=Mon, 01-Jun-2020 10:31:46 GMT; Max-Age=0; path=/wp-admin/rest-proxy/; domain=public-api.wordpress.com; secure; SameSite=None wp_api_sec=+; expires=Mon, 01-Jun-2020 10:31:46 GMT; Max-Age=0; path=/; domain=public-api.wordpress.com; secure; HttpOnly; SameSite=None
content-encoding: gzip
x-ac: 2.vie _dca
strict-transport-security: max-age=15552000

GET
H2 200 index.html Show response
widgets.wp.com/likes/ Frame C4AD 126 B
195 B 18ms
17ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/index.html?ver=20210413
Requested by: Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyFzUEKwkAMheELmQ5DocWFeJZaY8kwyYxJBu3traBQV67e4v/ghUeFuYijeEgWajFnNJsW7JIdwm/lcqGM0Ax1A+JAcitfRzLndkV7w3RvqOtnOib5i4Bp0clxj3fPmh2qlue6tTOf4hDHPvbDeEwvhOVG7A==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 6c79541d416470cf6276c0fe3e41528c51c823d125a45a1678355897fe9f3dc3

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/index.html?ver=20210413
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pentestlaboratories.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://pentestlaboratories.com/

Response headers

server: nginx
date: Tue, 01 Jun 2021 10:31:46 GMT
content-type: text/html
content-length: 126
last-modified: Sat, 23 Dec 2017 00:24:47 GMT
etag: "5a3da24f-7e"
x-ac: 4.vie _dca
access-control-allow-methods: GET, HEAD
access-control-allow-origin: *
timing-allow-origin: *
x-nc: HIT vie 2
accept-ranges: bytes

GET
H2 200 style.css
widgets.wp.com/likes/ Frame C4AD 4 KB
1 KB 18ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/style.css
Requested by: Host: widgets.wp.com
URL: https://widgets.wp.com/likes/index.html?ver=20210413
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: f8291c2dfd40b03e80064b0606e575b596426592287554a2a985f70430f8a230

Request headers

Referer: https://widgets.wp.com/likes/index.html?ver=20210413
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
server: nginx
etag: W/"5bfee306-12d7"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Sat, 23 Oct 2021 01:51:29 GMT

GET
H2 200 star-yellow-sml.png
polldaddy.com/images/ratings/ 3 KB
3 KB 171ms
171ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/star-yellow-sml.png
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
last-modified: Thu, 24 Dec 2015 22:38:25 GMT
server: nginx
etag: "567c73e1-c0d"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3085
expires: Thu, 01 Jul 2021 10:31:46 GMT

GET
H2 200 info.png
polldaddy.com/images/ratings/ 1 KB
1 KB 172ms
172ms Image
image/png 192.0.123.248
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://polldaddy.com/images/ratings/info.png
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.123.248 Los Angeles, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: polldaddy.com
Software: nginx /
Resource Hash: 8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:46 GMT
last-modified: Thu, 24 Dec 2015 22:38:03 GMT
server: nginx
etag: "567c73cb-4ca"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1226
expires: Thu, 01 Jul 2021 10:31:46 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame E7DA 22 KB
5 KB 18ms
17ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/rlt-proxy.js?m=20210413
Requested by: Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88

Request headers

Referer: https://public-api.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 21:48:08 GMT
server: nginx
etag: W/"60663f98-56cb"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Thu, 14 Apr 2022 02:02:09 GMT

GET
H2 200 batch Show response
public-api.wordpress.com/rest/v1/ Frame E7DA 542 B
428 B 232ms
231ms XHR
application/json 192.0.78.23
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://public-api.wordpress.com/rest/v1/batch?http_envelope=1&urls[]=/me&urls[]=/sites/151987412/posts/3042/likes&urls[]=/sites/151987412/posts/3042/reblogs/mine

Requested by

Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.23 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8006a6577e10cd0fa84b43f811a0ff8c92276dc11438a0a976e13c7143eac89d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public-api.wordpress.com/wp-admin/rest-proxy/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-hacker: Oh, Awesome: Opossum
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, must-revalidate, max-age=0
x-ac: 2.vie _dca
strict-transport-security: max-age=15552000
host-header: WordPress.com
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 12 KB
3 KB 18ms
17ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20201002
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 567b9db6dae11476eddb5328bfcd2977e165f2a9bee36c417ba5b4a47265e99a

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
server: nginx
etag: W/"5f88539e-376b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 22 Oct 2021 18:33:07 GMT

GET
H2 200 actionbar.js Show response
s0.wp.com/wp-content/mu-plugins/actionbar/ 15 KB
5 KB 18ms
18ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20201002
Requested by: Host: pentestlaboratories.com
URL: https://pentestlaboratories.com/2021/06/01/threat-hunting-amsi-bypasses/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 7d4d250af967a07b7066ef13b91d26e5fe9177fbd3f29b137186b1c35a2afd1c

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
content-encoding: gzip
server: nginx
etag: W/"5f88539e-4f45"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
x-ac: 4.vie _dca
timing-allow-origin: *
expires: Fri, 22 Oct 2021 18:33:07 GMT

GET
H2 200 wpcom-gray-white.png
s0.wp.com/i/logo/ 8 KB
8 KB 20ms
20ms Image
image/png 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s0.wp.com/i/logo/wpcom-gray-white.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT vie 2
date: Tue, 01 Jun 2021 10:31:46 GMT
x-ac: 4.vie _dca
last-modified: Wed, 28 Nov 2018 18:48:45 GMT
server: nginx
etag: "5bfee30d-200b"
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 8203
expires: Sat, 23 Oct 2021 01:51:42 GMT

GET
H2 204 boom.gif
pixel.wp.com/ 0
36 B 18ms
17ms Image
text/plain 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/boom.gif?bilmur=1&cumulative_layout_shift=0.057&largest_contentful_paint=771&provider=wordpress.com&service=simple&effective_connection_type=4g&host_name=pentestlaboratories.com&url_path=%2F2021%2F06%2F01%2Fthreat-hunting-amsi-bypasses%2F&navtime_dns=10&navtime_tcp=22&navtime_tls=48&navtime_ttfb=420&navtime_download=655&navtime_load=1530&navtime_dcl=1176&start_render=771&first_contentful_paint=771&resource_size=1107931&resource_transferred=387286&js_size=405633&js_transferred=122688&resource_cache_percent=0&js_cache_percent=0&last_resource_end=1628
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pentestlaboratories.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 10:31:48 GMT
cache-control: no-cache
server: nginx

Verdicts & Comments Add Verdict or Comment

109 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s0.wp.com/_static/??-eJyFzUEKwkAMheELmQ5DocWFeJZaY8kwyYxJBu3traBQV67e4v/ghUeFuYijeEgWajFnNJsW7JIdwm/lcqGM0Ax1A+JAcitfRzLndkV7w3RvqOtnOib5i4Bp0clxj3fPmh2qlue6tTOf4hDHPvbDeEwvhOVG7A==(Line 820) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
2.gravatar.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
pentestlaboratories.com
pentestlaboratories.files.wordpress.com
pixel.wp.com
polldaddy.com
public-api.wordpress.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
widgets.wp.com
192.0.123.248
192.0.72.27
192.0.76.3
192.0.77.32
192.0.78.18
192.0.78.23
192.0.78.25
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a00:1450:4001:831::200a
2a03:2880:f01c:800e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
045469f2d577c2ad73219bbd713640bcb4a4f9a46cecc6c0df0e66338646b27f
05914b956e9d0107351bca1ace8c4288c28c331338dc746b93f70bbe058502cf
07e12d37545f79300fc9746e78200ef598de94548d1304e7897445b1901a2daa
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
1127fb86a27e063f7c16f71e8c9a3c6d087dc02964718b664a0c3dd8525d2567
12b21a2d3fde07cf06583fbad384ba1bd37fb39bd1e4c2f208d6be41e3b19dd8
13c6db1ac0497928444e50aac43b5213354270c74537966202618efc12778122
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d
1aa88657bf87ae1676ce37f736eab2fbb82caa1a3631e36ebcb41aa484dae9de
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1d48bbb23e6a6408c0629a336159147380418de969c0687d636d703e8b35abd5
1f640ab8c9d79312bcbe429ae5e2090eb6de2b1bed61f3f8729e1461731155c7
261f6d41152c23901b04f84482ab4d64a653d6727d0b0be520467961bf73d60e
2707e0c95ef9e6fcea39cb6c17fb6cf2c630668c61b92b1c02870dfc18bfe08f
2b787dd1927b1cd247687f620670aa7b497a075bd5a418721b59fa5fb912ed55
2e443dbb116d4efb3edfddb77cd4b2c93313cb6d8e75800602a92f0a9fa22d88
2fba87fbe65763ca1e4026686befd9c869321bc95803a270c2a5d6c500534e7d
3649e67c6a63061b530e7e8ee7b4d3c850fa6a88f4d0f3929be0a377fb5b4c41
3742b8f2006b7a23df3252c615bb113e94f77729ac9cc4b021e35517285cf0c2
3bb9a06c0996de23b64c4b3c2982a0fea5553e388c2f8024def04df65bb66b4d
3e28d3fce7981c08fdbca297fba1501e9505ab99ebdd3fc0899a707f696308f6
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
43ce0993233b47e22f0301e3ab3e2d369e497d42f002e4e2729388e50fa50324
43fe33efd7b9aeb21d66eaa40be4db4bbfe40ac9fe37c856472fb312ba81ef63
4a82bed4d069950b1f5e43cdfb5b107eee29ee9e60b6363543b3f3ee58e0f558
4f4524f7e1a87079bc50a64681f880ccf3e6f5db1ec5fc27949377532a3881da
5051802b58b6894f351acdd43360a21488da683209c11844b0f7441df1a1f5ba
508c7309c11430e3d80e2f203836ac3f26ea2ef3127239fa47592661523a94f0
567b9db6dae11476eddb5328bfcd2977e165f2a9bee36c417ba5b4a47265e99a
5ad4f0148f584616f5022ad1cf3f27801eb12f02016d17ded07cef116e5f8887
67f5e3a1fe926d54a765050fbdae81d08d4908c38c3a2340322ec7f5086df9e3
6bf8b2cd55ee25d796364a66508ef6179389466174a439eba13069d8b233f39d
6c79541d416470cf6276c0fe3e41528c51c823d125a45a1678355897fe9f3dc3
753317c58e485fe930390c7d2b9a30e6609a274456a37384506950283004664b
75e485d4939193b87d2c1fcb13b8a2c4a6e74efd10363dbf6bd462b0a8b65467
7d08e9159f7d2bf0835085cbd1ffb0252b0e11de45ed07db4447f8e63f181dbf
7d4d250af967a07b7066ef13b91d26e5fe9177fbd3f29b137186b1c35a2afd1c
7ddaad7c329d4d1405914ebfd87e94f8876d14ffd8a665fee7be24f087c98e4c
8006a6577e10cd0fa84b43f811a0ff8c92276dc11438a0a976e13c7143eac89d
810614de7cadb90bbd76f5742707a504a7ce884ce01c1d1021ba48e9f001da32
89d01b152beefa0885d7821cea6cc319054d5e272549b004479a6ac81ecafee3
8d1b51a6bcf97a173884161816c19b753e0088a0926148482d8a1f371706c774
923e3009de4c32eb9cad94e6d350b077cb806a3bb02b31fb0595ef3adef0b35c
943b942380a519d6a9c14a7f040e3db6a6112c3dcdf55d17a9b5ca859205158c
95fddf05b0a4211a795d0d4e3774dc4a865e624f845917dc5add7f4b45893edf
96a175a0dee54d0e9c857ca3505da6bba6f4e3e187a9f53ebd7fd1d2068ab084
9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087
a5bc80201d208f16bc81a2fafacab9b99503d04afe96b8f2524e9ae6768ccb04
aaa5c804f7a331ebdac8988c462bfc09ab5fb7d80a699da7ed1d1f3683b6bbf5
ae82e42491a7de3c5d3df779e9600e5191708025e8c46102ccfa7026df735d64
b4f396a8aaf313e0798f971317151c0716b476f90b8fe539280a094efd420157
b70891fc93d3d70dd404dc552206fef8430a1cf1adf5d9fdbec73c4fc712ca8e
b99c17d3ad46b558907c6b7d136f43a7f10daacbb3972f68c347dad13cb2e654
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
c9285c4c652d4650594b6468a37df94313bbc1fbcfb22dfe7e05c0f18e0cf82c
c987e56e0bf8e65d48229768927f8776cbc2e500dcd9924603617365516fd3d8
cb8943abdc046f98c2a74cbe013552f1ed2a5746fd76546ed63f60d32dd83615
cc74ed96b7cded3057097292949692d7a212bcadd50a213a9ad78ddd55ba81e6
cdf3f88beb166e98d2656e957b247c886d1702027559a290e74a02d58d950c8c
cf6c56fe71c3a0a2ee4e9e6e1760949e1fc2fe68ed6edee89d72c2156b3a7cd1
d0664ba530cba82fbf718324ef0284950f77927d3b6538c920957f0976bcaed6
d2eb21a830fc166171fdc5fb7e3625520588456966d6a470d7b03a3690987d70
d344ad7b632a91201b85b7a93b210cc37f0f0f409a55a02c8c5e876b209cadc0
d5fd2abdea58c90fb96bc21e68318af1eeb99bb53db5bcccb0438ad29ddfd421
e1bfde496852baa24aa274ab7345c8d31119f15d63ec62a5ed2448b8dfbff3c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ea4e511204fb4791ddf01acb0ae3d3030e7f359f81f6cb8a321310e91c266546
eb3fea583d5f148b0c645dcdd7f35504abc085e9cfabc4cb1902f9611779bf07
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f648696e64e46c7478724780a9d9d3bf5a18d72a3555a6417c232f0f032a8a5d
f8291c2dfd40b03e80064b0606e575b596426592287554a2a985f70430f8a230
fc1b2b1eaf819b0406a9885edc7cc985c6cbd599e90f4e41da81795acfb19578
fed11b98ab14755ff5015f63b0546dd4d644b738858555f525620a20cd16a2a5

pentestlaboratories.com Open in urlscan Pro 192.0.78.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

75 Requests

100 %HTTPS

42 %IPv6

8 Domains

15 Subdomains

13 IPs

3 Countries

1128 kBTransfer

2130 kBSize

0 Cookies

22 Outgoing links

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

pentestlaboratories.com Open in urlscan Pro
192.0.78.25 Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

100 %
HTTPS

42 %
IPv6

8
Domains

15
Subdomains

13
IPs

3
Countries

1128 kB
Transfer

2130 kB
Size

0
Cookies

75 HTTP transactions
3 data transactions