blog.romanrii.com Open in urlscan Pro
74.208.236.115 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Submission: On February 16 via manual (February 16th 2021, 12:30:30 am UTC) from US

Summary HTTP 23 Redirects Links 6 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 23 HTTP transactions. The main IP is 74.208.236.115, located in United States and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is blog.romanrii.com.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on January 8th 2021. Valid for: a year.

This is the only time blog.romanrii.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
18	74.208.236.115 74.208.236.115		8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	2a00:1450:400... 2a00:1450:4001:80f::200a		15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2003		15169 (GOOGLE) (GOOGLE)
23	3

18 74.208.236.115 (United States)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: 74-208-236-115.elastic-ssl.ui-r.com

blog.romanrii.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	romanrii.com blog.romanrii.com	177 KB
4	gstatic.com fonts.gstatic.com	84 KB
1	googleapis.com fonts.googleapis.com	800 B
23	3

	Domain	Requested by
18	blog.romanrii.com	blog.romanrii.com
4	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	blog.romanrii.com
23	3

This site contains links to these domains. Also see Links.

Domain
romanrii.com
github.com
www.youtube.com
www.andersnoren.se

Subject Issuer	Validity	Valid
*.romanrii.com Encryption Everywhere DV TLS CA - G1	`2021-01-08` - `2022-01-21`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Frame ID: 4D8E0BA3DD0A39BD1FFBD1B083A7FB1B
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

23
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

262 kB
Transfer

445 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://romanrii.com/
Title: Home

Search URL Search Domain Scan URL

URL: https://github.com/RomanRII
Title: GitHub

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCW_SNMn66Xy36jkRAifBmQQ
Title: YouTube

Search URL Search Domain Scan URL

URL: https://romanrii.com/contact-me.html
Title: Contact Me

Search URL Search Domain Scan URL

URL: https://github.com/RomanRII/shellcode-through-ICMP
Title: https://github.com/RomanRII/shellcode-through-ICMP

Search URL Search Domain Scan URL

URL: https://www.andersnoren.se/
Title: Anders Noren

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request using-icmp-to-deliver-shellcode Show response
blog.romanrii.com/ 42 KB
11 KB 1721ms
1410ms Document
text/html 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache / PHP/7.4.15
Resource Hash: 94f5c84f170da7130f64ccbfac76d308e2a3e8045880cb672a64892eacffbe03

Request headers

:method: GET
:authority: blog.romanrii.com
:scheme: https
:path: /using-icmp-to-deliver-shellcode
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 16 Feb 2021 00:30:12 GMT
server: Apache
x-powered-by: PHP/7.4.15
x-pingback: https://blog.romanrii.com/xmlrpc.php
link: <https://blog.romanrii.com/wp-json/>; rel="https://api.w.org/", <https://blog.romanrii.com/wp-json/wp/v2/posts/156>; rel="alternate"; type="application/json", <https://blog.romanrii.com/?p=156>; rel=shortlink
content-encoding: gzip

GET
H2 200 style.min.css
blog.romanrii.com/wp-includes/css/dist/block-library/ 50 KB
10 KB 178ms
176ms Stylesheet
text/css 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 5c2288ca7b324881faae5e368eb4d69457e2784e042e868de335d3827bb90981

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "c8e9-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 9893
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 jquery.lazyloadxt.spinner.css
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/ 311 B
449 B 151ms
149ms Stylesheet
text/css 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/jquery.lazyloadxt.spinner.css?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: d982c4fff78c63ed84481eb36845e3b9e2753bfe996a3ba45835f75c6af1dc55

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "137-5b7c29cae9275-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 213
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
800 B 18ms
16ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700

Requested by

Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a52d39dd21dc4636cf8590245402a5f2bb5da0ec6bca439e4101aece3b30dca4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 00:30:13 GMT
server: ESF
date: Tue, 16 Feb 2021 00:30:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 Feb 2021 00:30:13 GMT

GET
H2 200 style.css
blog.romanrii.com/wp-content/themes/hemingway/ 49 KB
13 KB 235ms
233ms Stylesheet
text/css 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/themes/hemingway/style.css?ver=2.1.0
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: a5ed1cc321fe689169124d392fedf0f4cae7b8bb4548b47e979dd255efbe3274

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Wed, 26 Aug 2020 12:20:23 GMT
server: Apache
etag: "c570-5adc6d80fd4db-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 12810
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 cookies.js Show response
blog.romanrii.com/wp-content/mu-plugins/ionos-assistant/js/ 924 B
705 B 236ms
234ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/mu-plugins/ionos-assistant/js/cookies.js?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 64fab1839edeb799a6cf617ec3dd330bead9e94b03d5c7022060ea7723334635

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Fri, 05 Feb 2021 19:09:46 GMT
server: Apache
etag: "39c-5ba9b903f6431-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 459
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 jquery.min.js Show response
blog.romanrii.com/wp-includes/js/jquery/ 87 KB
36 KB 309ms
307ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "15d98-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 36153
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 jquery-migrate.min.js Show response
blog.romanrii.com/wp-includes/js/jquery/ 11 KB
5 KB 193ms
191ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "2bd8-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 4563
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 global.js Show response
blog.romanrii.com/wp-content/themes/hemingway/assets/js/ 2 KB
1 KB 201ms
199ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/themes/hemingway/assets/js/global.js?ver=2.1.0
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: d56ab39cd5b185ec6c42decae9edbdd871e6252adbb2cfdb4ab526c7cae58497

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Wed, 26 Aug 2020 12:20:23 GMT
server: Apache
etag: "8a6-5adc6d80f6779-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 832
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 comment-reply.min.js Show response
blog.romanrii.com/wp-includes/js/ 3 KB
2 KB 185ms
183ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/js/comment-reply.min.js?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:13 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "ba6-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 1391
expires: Tue, 16 Mar 2021 00:30:13 GMT

GET
H2 200 jquery.lazyloadxt.extra.min.js Show response
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/ 3 KB
2 KB 371ms
219ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extra.min.js?ver=2.4.3
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 2b3c6f1d3cea37b4d8cc609a141b421a88bcaf2f3646965f9f95f4d4a683c949

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
content-encoding: gzip
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "bc7-5b7c29caf4df9-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 1575
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 jquery.lazyloadxt.srcset.min.js Show response
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/ 2 KB
1 KB 373ms
190ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.srcset.min.js?ver=2.4.3
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 21dc21cf1cc77b458d114634e3775e70f229dc0c215b0c8958920e2079cb5a16

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
content-encoding: gzip
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "625-5b7c29caf6d39-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 782
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 jquery.lazyloadxt.extend.js Show response
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/ 1 KB
679 B 374ms
187ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extend.js?ver=2.4.3
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: a8a819d7548b9c102d7776cb645212ca1e324ac2de2170598699061e29bc6cbf

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
content-encoding: gzip
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "415-5b7c29caf3e58-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 433
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 wp-embed.min.js Show response
blog.romanrii.com/wp-includes/js/ 1 KB
1 KB 377ms
183ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/js/wp-embed.min.js?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "592-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 779
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 wp-emoji-release.min.js Show response
blog.romanrii.com/wp-includes/js/ 14 KB
5 KB 150ms
150ms Script
application/javascript 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.romanrii.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.1
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
content-encoding: gzip
last-modified: Thu, 04 Feb 2021 08:10:18 GMT
server: Apache
etag: "3795-5ba7e3bf34e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 5273
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 cropped-Code.png
blog.romanrii.com/wp-content/uploads/2020/02/ 80 KB
80 KB 168ms
168ms Image
image/png 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.romanrii.com/wp-content/uploads/2020/02/cropped-Code.png
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 22690b1f8fb440ea3530c5230f00da901a7b0be8adaab856f87fbe78062a2651

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
last-modified: Sun, 02 Feb 2020 08:20:15 GMT
server: Apache
etag: "140d1-59d9379f69e40"
content-type: image/png
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 82129
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 loading.gif
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/ 2 KB
2 KB 147ms
146ms Image
image/gif 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/loading.gif
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/jquery.lazyloadxt.spinner.css?ver=5.6.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: b6e4dff920e21e3f436a014140d01d43c97177e007556ede69f772f08cb7a7ec

Request headers

Referer: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/css/jquery.lazyloadxt.spinner.css?ver=5.6.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "69a-5b7c29cae9275"
content-type: image/gif
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 1690
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v19/ 41 KB
42 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb0c201f0ca67e745869967d48db2e90bf01353d1f305959d487291cab6d0755

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.romanrii.com
Referer: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 01:07:34 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:51:07 GMT
server: sffe
age: 256960
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42444
x-xss-protection: 0
expires: Sun, 13 Feb 2022 01:07:34 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/ 14 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.romanrii.com
Referer: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 13 Feb 2021 06:30:25 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:59 GMT
server: sffe
age: 237589
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14044
x-xss-protection: 0
expires: Sun, 13 Feb 2022 06:30:25 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/ 14 KB
14 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.romanrii.com
Referer: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 11 Feb 2021 12:56:26 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:25 GMT
server: sffe
age: 387228
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14176
x-xss-protection: 0
expires: Fri, 11 Feb 2022 12:56:26 GMT

GET
H2 200 S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2
fonts.gstatic.com/s/lato/v17/ 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe4bbdad1d6dff75cde79f8afc07f29502bd4708cb0ce5f552083c3d81ba8382

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://blog.romanrii.com
Referer: https://fonts.googleapis.com/css?family=Lato%3A400%2C700%2C400italic%2C700italic%7CRaleway%3A400%2C700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 04:25:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:59 GMT
server: sffe
age: 331476
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14864
x-xss-protection: 0
expires: Sat, 12 Feb 2022 04:25:38 GMT

GET
H2 200 lazy_placeholder.gif
blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/images/ 42 B
238 B 192ms
192ms Image
image/gif 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.romanrii.com/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
last-modified: Thu, 31 Dec 2020 13:29:23 GMT
server: Apache
etag: "2a-5b7c29caf1f18"
content-type: image/gif
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 42
expires: Tue, 16 Mar 2021 00:30:14 GMT

GET
H2 200 image-11.png
blog.romanrii.com/wp-content/uploads/2021/02/ 7 KB
7 KB 168ms
168ms Image
image/png 74.208.236.115
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.romanrii.com/wp-content/uploads/2021/02/image-11.png
Requested by: Host: blog.romanrii.com
URL: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.208.236.115 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS: 74-208-236-115.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 9c7c0aecedffbcf4fbefe65cba99bf50d163bc2e8675956b6f87257406f8529d

Request headers

Referer: https://blog.romanrii.com/using-icmp-to-deliver-shellcode
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 16 Feb 2021 00:30:14 GMT
last-modified: Mon, 15 Feb 2021 10:39:45 GMT
server: Apache
etag: "1a51-5bb5d9ab660f8"
content-type: image/png
cache-control: max-age=2419200
accept-ranges: bytes
content-length: 6737
expires: Tue, 16 Mar 2021 00:30:14 GMT

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings function| switchFeature function| setCookie function| getCookie undefined| $ function| jQuery boolean| jQueryMigrateHelperHasSentDowngrade object| addComment object| a3_lazyload_params object| a3_lazyload_extend_params object| wp object| twemoji

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blog.romanrii.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.romanrii.com
fonts.googleapis.com
fonts.gstatic.com
2a00:1450:4001:80f::200a
2a00:1450:4001:811::2003
74.208.236.115
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
21dc21cf1cc77b458d114634e3775e70f229dc0c215b0c8958920e2079cb5a16
22690b1f8fb440ea3530c5230f00da901a7b0be8adaab856f87fbe78062a2651
2b3c6f1d3cea37b4d8cc609a141b421a88bcaf2f3646965f9f95f4d4a683c949
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c2288ca7b324881faae5e368eb4d69457e2784e042e868de335d3827bb90981
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
64fab1839edeb799a6cf617ec3dd330bead9e94b03d5c7022060ea7723334635
94f5c84f170da7130f64ccbfac76d308e2a3e8045880cb672a64892eacffbe03
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9c7c0aecedffbcf4fbefe65cba99bf50d163bc2e8675956b6f87257406f8529d
a52d39dd21dc4636cf8590245402a5f2bb5da0ec6bca439e4101aece3b30dca4
a5ed1cc321fe689169124d392fedf0f4cae7b8bb4548b47e979dd255efbe3274
a8a819d7548b9c102d7776cb645212ca1e324ac2de2170598699061e29bc6cbf
ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2
b6e4dff920e21e3f436a014140d01d43c97177e007556ede69f772f08cb7a7ec
bb0c201f0ca67e745869967d48db2e90bf01353d1f305959d487291cab6d0755
d56ab39cd5b185ec6c42decae9edbdd871e6252adbb2cfdb4ab526c7cae58497
d982c4fff78c63ed84481eb36845e3b9e2753bfe996a3ba45835f75c6af1dc55
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe4bbdad1d6dff75cde79f8afc07f29502bd4708cb0ce5f552083c3d81ba8382