cloudbrothers.info
Open in
urlscan Pro
2a02:c206:3006:6536::1
Public Scan
Submitted URL: http://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/
Effective URL: https://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/
Submission: On October 12 via api from SA — Scanned from DE
Effective URL: https://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/
Submission: On October 12 via api from SA — Scanned from DE
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 21 HTTP transactions.
The main IP is 2a02:c206:3006:6536::1, located in
Germany and
belongs to CONTABO, DE.
The main domain is cloudbrothers.info.
TLS certificate: Issued by R11 on September 17th 2024. Valid for: 3 months.
This is the only time cloudbrothers.info was scanned on urlscan.io!
TLS certificate: Issued by R11 on September 17th 2024. Valid for: 3 months.
This is the only time cloudbrothers.info was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 21 | 2a02:c206:300... 2a02:c206:3006:6536::1 | 51167 (CONTABO) (CONTABO) | |
| 21 | 1 |
21
2a02:c206:3006:6536::1
(Germany)
ASN51167 (CONTABO, DE)
ASN51167 (CONTABO, DE)
| cloudbrothers.info | |
| plausible.cloudbrothers.info |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
cloudbrothers.info
cloudbrothers.info plausible.cloudbrothers.info |
409 KB |
| 21 | 1 |
| Domain | Requested by | |
|---|---|---|
| 19 | cloudbrothers.info |
cloudbrothers.info
|
| 2 | plausible.cloudbrothers.info |
cloudbrothers.info
plausible.cloudbrothers.info |
| 21 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| github.com |
| infosec.exchange |
| twitter.com |
| buymeacoffee.com |
| www.picussecurity.com |
| gist.github.com |
| learn.microsoft.com |
| www.eicar.org |
| techcommunity.microsoft.com |
| chris-brumm.medium.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cloudbrothers.info R11 |
2024-09-17 - 2024-12-16 |
3 months | crt.sh |
| plausible.cloudbrothers.info R10 |
2024-09-16 - 2024-12-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/
Frame ID: ADA0EB63B833D7DCD9AC977B7CA6567E
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Create persistent Defender AV exclusions and circumvent Defender for Endpoint detection - CloudbrothersPage URL History Show full URLs
-
http://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-det...
HTTP 307
https://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-det... Page URL
Detected technologies
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Clipboard.js
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
19 Outgoing links
These are links going to different origins than the main page.
URL: https://github.com/f-bader/
Search URL Search Domain Scan URL
URL: https://infosec.exchange/@fabian_bader
Search URL Search Domain Scan URL
URL: https://twitter.com/fabian_bader
Search URL Search Domain Scan URL
URL: https://buymeacoffee.com/fabianbader
Search URL Search Domain Scan URL
URL: https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1562-impair-defenses
Title: public guidelines
Title: public guidelines
Search URL Search Domain Scan URL
URL: https://gist.github.com/alexverboon/f2f52279a8a38583bca0589fdf88f9d9
Title: hunting queries
Title: hunting queries
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?WT.mc_id=AZ-MVP-5004810
Title: Microsoft Defender for Endpoint
Title: Microsoft Defender for Endpoint
Search URL Search Domain Scan URL
URL: https://twitter.com/gentilkiwi/status/1420069224106577927
Title: quite easy
Title: quite easy
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/scenarios-endpoint-protection?WT.mc_id=AZ-MVP-5004810
Title: System Center Endpoint Protection (SCEP)
Title: System Center Endpoint Protection (SCEP)
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-local-policy-overrides-microsoft-defender-antivirus?view=o365-worldwide?WT.mc_id=AZ-MVP-5004810#use-group-policy-to-disable-local-list-merging
Title: Configure local administrator merge behavior for lists
Title: Configure local administrator merge behavior for lists
Search URL Search Domain Scan URL
URL: https://www.eicar.org/?page_id=3950
Title: EICAR test string
Title: EICAR test string
Search URL Search Domain Scan URL
URL: https://github.com/SwiftOnSecurity/sysmon-config
Title: sysmon configuration file
Title: sysmon configuration file
Search URL Search Domain Scan URL
URL: https://twitter.com/SwiftOnSecurity
Title: SwiftOnSecurity
Title: SwiftOnSecurity
Search URL Search Domain Scan URL
URL: https://github.com/f-bader/sysmon-config/blob/master/sysmonconfig-export.xml
Title: modification
Title: modification
Search URL Search Domain Scan URL
URL: https://techcommunity.microsoft.com/t5/microsoft-security-baselines/lgpo-exe-local-group-policy-object-utility-v1-0/ba-p/701045?WT.mc_id=AZ-MVP-5004810
Title: LGPO
Title: LGPO
Search URL Search Domain Scan URL
URL: https://learn.microsoft.com/en-us/windows/security/threat-protection/security-compliance-toolkit-10?WT.mc_id=AZ-MVP-5004810
Title: Microsoft Security Compliance Toolkit
Title: Microsoft Security Compliance Toolkit
Search URL Search Domain Scan URL
URL: https://twitter.com/cbrhh
Title: Chris Brumm
Title: Chris Brumm
Search URL Search Domain Scan URL
URL: https://chris-brumm.medium.com/
Title: Blog
Title: Blog
Search URL Search Domain Scan URL
URL: https://chris-brumm.medium.com/my-learnings-on-microsoft-defender-for-endpoint-and-exclusions-ddacf2fdd047
Title: Defender AV exclusions
Title: Defender AV exclusions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/
HTTP 307
https://cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/ Redirect Chain
|
62 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
normalize.min.css
cloudbrothers.info/lib/normalize/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
cloudbrothers.info/css/ |
67 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.css
cloudbrothers.info/lib/fontawesome-free/ |
99 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
animate.min.css
cloudbrothers.info/lib/animate/ |
57 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
plausible.outbound-links.js
plausible.cloudbrothers.info/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
loading.min.svg
cloudbrothers.info/svg/ |
482 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
smooth-scroll.min.js
cloudbrothers.info/lib/smooth-scroll/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
autocomplete.min.js
cloudbrothers.info/lib/autocomplete/ |
56 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lunr.min.js
cloudbrothers.info/lib/lunr/ |
29 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lunr.stemmer.support.min.js
cloudbrothers.info/lib/lunr/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lunr.de.min.js
cloudbrothers.info/lib/lunr/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lazysizes.min.js
cloudbrothers.info/lib/lazysizes/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
clipboard.min.js
cloudbrothers.info/lib/clipboard/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
theme.min.js
cloudbrothers.info/js/ |
22 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-solid-900.woff2
cloudbrothers.info/lib/webfonts/ |
78 KB 78 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-brands-400.woff2
cloudbrothers.info/lib/webfonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-regular-400.woff2
cloudbrothers.info/lib/webfonts/ |
13 KB 14 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
event
plausible.cloudbrothers.info/api/ |
2 B 280 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
cloudbrothers.info/ |
15 KB 15 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
RegChangeAsSystem.png
cloudbrothers.info/en/create-persistent-defender-av-exclusions-circumvent-defender-endpoint-detection/images/ |
103 KB 104 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| SmoothScroll function| autocomplete function| lunr object| lazySizes function| ClipboardJS object| config function| _objectDestructuringEmpty function| _createForOfIteratorHelper function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| _classCallCheck function| _defineProperties function| _createClass function| Util function| Theme function| themeInit function| plausible number| _zid0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' https://plausible.cloudbrothers.info/js/plausible.outbound-links.js; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' https://plausible.cloudbrothers.info; font-src 'self'; frame-src 'self' https://www.youtube-nocookie.com; img-src 'self'; manifest-src 'self'; media-src 'self'; worker-src 'none' frame-ancestors 'self'; |
| Strict-Transport-Security | max-age=63072000 |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cloudbrothers.info
plausible.cloudbrothers.info
2a02:c206:3006:6536::1
01b035efb5dfa529c512f82962ed633328222da6f33c224244806d4798c67349
055364f5be272caa092b0e6654c165828707f8ab971e2656383a6d6392bc345e
1545767456915a7f74953836cfcdada1debda95e349712c04a3fefe2ce37ed69
1e2694bed152fa2922dbe909a441838ed693d88b1330f97485bfa8ed78da42df
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3c770e90f98eb21b0c042fafb49755af93306fbaf42e449524f94fae9fc83295
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
5fe45a7e3b5c641ada745a7b76fd10f6f5dec709055f817cb1bdbc6e1623fc09
615590a2ca2b667afa7c02ef396f5500b62e22795ddbb46448f90494605d09a5
6a8c8e9e1e7f692c21af1956de163f3d026778e6449fe93a09a671847ca1ae65
7ddba0fd35ba811d3c5d3567dec6d7ac6e1f6fa0c674bf28119b5efae484e30c
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
8127f0ca4cabc7246f3620f3ef3bf9b1db02805dfe03d6d4c57bc74bc0bf6eea
8453452ed9afac8bcb6be33820367a5dc7bf3f630b3b43889c3ebcb6936e5c02
8a7739925f4c03586479852df840b7061948832a7fda30c8c812d2ea4dd4c4f2
b9ba70835fb3fc9e3860deb1d6c6eb7d004b1775e8e0a2051dbf33e1dc096356
bc1b48d6665b99d3ff8690f763dd9b190847dd29968b8fdc7899d92ec2a4742d
bcff85fb5e00d68802850b393ac7792c997f722f536f38e26638c46dca8e5eb6
df84a2d58ea594c04a3371b48d020b55ea10284c2ec636e4e331965d7313e29b
f51938f3065a40ee841bcb558e4330e31fd26c0ea55343fff8770b88b0319a3c
fb649fcae62177dfe63e67081ddceb830b5ce1f05a4184e9bbb7d87ac4b8f4e5