reconshell.com Open in urlscan Pro
18.158.98.109 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://reconshell.com/active-directory-purple-teaming/
Submission: On May 30 via api (May 30th 2022, 6:44:19 pm UTC) from US — Scanned from DE

Summary HTTP 115 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 15 domains to perform 115 HTTP transactions. The main IP is 18.158.98.109, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is reconshell.com.
TLS certificate: Issued by R3 on April 26th 2022. Valid for: 3 months.

This is the only time reconshell.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
67	18.158.98.109 18.158.98.109	16509 (AMAZON-02) (AMAZON-02)
9	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	148.251.1.246 148.251.1.246	24940 (HETZNER-AS) (HETZNER-AS)
1	2600:9000:231... 2600:9000:2315:3800:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:231... 2600:9000:2315:4000:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f1c:a99... 2600:1f1c:a99:832c:2615:337c:6c9e:c761	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
115	21

67 18.158.98.109 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com

reconshell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 148.251.1.246 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.246.1.251.148.clients.your-server.de

ad.a-ads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.a-ads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2315:3800:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:7eb1:3826:be7e:d981 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2315:4000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f1c:a99:832c:2615:337c:6c9e:c761 (San Jose, United States)

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
67	reconshell.com reconshell.com	2 MB
9	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 173	153 KB
8	googlesyndication.com 50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 136	40 KB
6	google.com adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	2 KB
5	google.de adservice.google.de — Cisco Umbrella Rank: 8526	1 KB
4	gstatic.com fonts.gstatic.com	115 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	20 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 890 pixel.quantserve.com — Cisco Umbrella Rank: 412	10 KB
2	a-ads.com ad.a-ads.com — Cisco Umbrella Rank: 29443 static.a-ads.com — Cisco Umbrella Rank: 42968	652 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	108 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 862	429 B
1	ezoic.net go.ezoic.net — Cisco Umbrella Rank: 8711	2 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1599	1 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 42	2 KB
1	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 7419	98 KB
115	15

	Domain	Requested by
67	reconshell.com	reconshell.com
9	securepubads.g.doubleclick.net	reconshell.com securepubads.g.doubleclick.net
5	adservice.google.com	securepubads.g.doubleclick.net
5	adservice.google.de	securepubads.g.doubleclick.net
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	fonts.gstatic.com	fonts.googleapis.com
3	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	reconshell.com
1	www.google.com	tpc.googlesyndication.com
1	pixel.quantserve.com	reconshell.com
1	rules.quantcount.com	secure.quantserve.com
1	static.a-ads.com	ad.a-ads.com
1	50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	secure.quantserve.com	reconshell.com
1	go.ezoic.net	reconshell.com
1	ad.a-ads.com	reconshell.com
1	secure.gravatar.com	reconshell.com
1	fonts.googleapis.com	reconshell.com
1	go.ezodn.com	reconshell.com
115	20

This site contains links to these domains. Also see Links.

Domain
silktide.com
facebook.com
twitter.com
t.me
cve.reconshell.com
share.reconshell.com
feeds.reconshell.com
crackmyhash.com
github.com
www.facebook.com
pinterest.com
www.ezoic.com

Subject Issuer	Validity	Valid
reconshell.com R3	`2022-04-26` - `2022-07-25`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.a-ads.com Sectigo ECC Domain Validation Secure Server CA	`2021-12-08` - `2023-01-08`	a year	crt.sh
*.ezoic.net Amazon	`2022-01-16` - `2023-02-14`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://reconshell.com/active-directory-purple-teaming/
Frame ID: F11C049ECBC1CCFDE5480A1FA1A1F676
Requests: 108 HTTP requests in this frame

Frame: https://ad.a-ads.com/1946581?size=728x90
Frame ID: B9E936FCCA098D27BA41F144D419F28D
Requests: 3 HTTP requests in this frame

Frame: https://50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: B3E923CABE8BD6E7B8CC8DF5ADD15035
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E5BBA1AD955EA31351115680AC686D2A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 3FE14D4733EB61657AF5B01946D224E5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Active Directory Purple Teaming - Penetration Testing Tools, ML and Linux Tutorials

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OWL Carousel (Widgets) Expand

Overall confidence: 100%
Detected patterns

owl\.carousel.*\.js

Osano (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cookieconsent\.min\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

115
Requests

98 %
HTTPS

85 %
IPv6

15
Domains

20
Subdomains

21
IPs

3
Countries

2865 kB
Transfer

4878 kB
Size

26
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: http://silktide.com/cookieconsent
Title: Cookie Consent plugin for the EU cookie law

Search URL Search Domain Scan URL

URL: https://facebook.com/reconshell

Search URL Search Domain Scan URL

URL: https://twitter.com/reconshell

Search URL Search Domain Scan URL

URL: https://t.me/reconshell

Search URL Search Domain Scan URL

URL: https://cve.reconshell.com/
Title: CVE

Search URL Search Domain Scan URL

URL: https://share.reconshell.com/
Title: Share

Search URL Search Domain Scan URL

URL: https://feeds.reconshell.com/
Title: News

Search URL Search Domain Scan URL

URL: https://crackmyhash.com/
Title: CrackMyHash

Search URL Search Domain Scan URL

URL: https://github.com/MirHassanRiaz/Active-Directory-Purple-Teaming#assumed-breach-methodology

Search URL Search Domain Scan URL

URL: https://github.com/MirHassanRiaz/Active-Directory-Purple-Teaming#domain-enumeration-commands

Search URL Search Domain Scan URL

URL: https://github.com/MirHassanRiaz/Active-Directory-Purple-Teaming
Title: Source from

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Active+Directory+Purple+Teaming&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&via=reconshell
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&media=https://reconshell.com/wp-content/uploads/2022/05/purpal.png&description=Active+Directory+Purple+Teaming
Title: Share on Pinterest

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

115 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
reconshell.com/active-directory-purple-teaming/ 280 KB
42 KB 2570ms
2282ms Document
text/html 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PHP/7.4.29, PleskLin
Resource Hash: 73a51de126bf715562b4774f08560b78d2d1f6f474b575a43a517e12d45fba5a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 30 May 2022 18:44:12 GMT
display: pub_site_sol
expires: Sun, 29 May 2022 18:44:12 GMT
link: <https://reconshell.com/wp-json/>; rel="https://api.w.org/", <https://reconshell.com/wp-json/wp/v2/posts/8841>; rel="alternate"; type="application/json", <https://reconshell.com/?p=8841>; rel=shortlink
pagespeed: off
response: 200
server: nginx
vary: Accept-Encoding Accept-Encoding
x-ezoic-cdn: Bypass
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-origin-cache-control
x-powered-by: PHP/7.4.29, PleskLin
x-sol: pub_site

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 82 KB
28 KB 64ms
26ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

81e1cfa3d7d84ee85ec93158371e929dbc067311b76d83a053d4f377f5608da1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28123
x-xss-protection: 0
server: sffe
etag: "1231 / 943 of 1000 / last-modified: 1653689052"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 30 May 2022 18:44:12 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 335 KB
98 KB 135ms
65ms Script
application/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=adyoulike,amx,criteo,oftmedia,onemobile,onetag,pubmatic,pulsepoint,sharethrough,yieldmo&cb=195-0-39
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec0cf8e63b250cf3e74918dac833ab7fe10123ee4239015bb14bc0758c96cfe4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:12 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 19 May 2022 21:42:46 GMT
server: cloudflare
age: 939686
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MgZH%2FC55r6TRpRT9zkFfdk4yEd2QXLqDVBCwIDfDb90L1EL9iG3AEi%2FmBusmTUN15uzINOL1DDbrX6FqtWlIMBJMULSqUfidruyfo1wo17ZqU1yfFAGLwj7CBj%2FG4ZVxJCisQ099kLJg3b0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 71399eac9c7b0fd6-MRS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 banger.js Show response
reconshell.com/porpoiseant/ 54 KB
12 KB 98ms
95ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/porpoiseant/banger.js?cb=195-0&bv=116&v=58&PageSpeed=off
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5c12aeb1ff990a6bc269f96a8e21dd0585d27dcc478f61eb70357d03352619be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 wp-emoji-release.min.js Show response
reconshell.com/wp-includes/js/ 18 KB
4 KB 561ms
558ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "611fea74-4705-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2445466
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 core.css
reconshell.com/wp-content/plugins/pixwell-core/assets/ 35 KB
5 KB 502ms
501ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/pixwell-core/assets/core.css?ver=7.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: bf7299d2d2190861f97423878c241772cbf52460f8d93f7d0594ddd6fb2f75ed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5d05-8bbc-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=2592000

GET
H2 200 style.min.css
reconshell.com/wp-includes/css/dist/block-library/ 81 KB
10 KB 601ms
600ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "624d2e4c-145db-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=471096

GET
H2 200 styles.css
reconshell.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
939 B 416ms
416ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.6.1
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 849
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "62851ab8-aab-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=104595

GET
H2 200 dashicons.min.css
reconshell.com/wp-includes/css/ 58 KB
34 KB 633ms
633ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/css/dashicons.min.css?ver=5.9.3
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "6077d93f-e688-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=2592000

GET
H2 200 frontend.css
reconshell.com/wp-content/plugins/post-views-counter/css/ 289 B
229 B 396ms
396ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/post-views-counter/css/frontend.css?ver=1.3.11
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: f46d96d805c7e9e467422dfe516c43edb4632c0273cea26722fee7ba885f869e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 150
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "121-5d77ad0968613-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
x-accel-version: 0.01
cache-control: private, max-age=963888

GET
H2 200 form-basic.css
reconshell.com/wp-content/plugins/mailchimp-for-wp/assets/css/ 2 KB
644 B 370ms
369ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/mailchimp-for-wp/assets/css/form-basic.css?ver=4.8.7
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 874e5cb8757149fb23cff7ad37bdca20efbe22dc81ed2e24da4afc3d9928db72

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 461
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "622042f1-692-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=765479

GET
H2 200 main.css
reconshell.com/wp-content/themes/pixwell/assets/css/ 401 KB
51 KB 984ms
983ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/css/main.css?ver=7.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 1a2607e7e1cf536e8bbf0c90c0165e4d6e00e55ce7d8df109c7c2267bec64ca3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5c76-6454c-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
cache-control: private, max-age=2592000

GET
H2 200 style.css
reconshell.com/wp-content/themes/pixwell/ 448 B
306 B 387ms
387ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/style.css?ver=7.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 93bb2c7479294f878b3c23c97f7c5393d73af10322a88dd71059645ac6fd14f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 212
x-origin-cache-control
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "1c0-5c0231567d0ec-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: text/css
x-accel-version: 0.01
cache-control: private, max-age=2592000

GET
H2 200 css
fonts.googleapis.com/ 27 KB
2 KB 44ms
20ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CTitillium+Web%3A600%2C700&font-display=swap&ver=1641491597

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

955442a1f4c09093797504c109ac6148da8c87a8d449197508aed99efd65b5f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 30 May 2022 18:40:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 30 May 2022 18:44:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 30 May 2022 18:44:12 GMT

GET
H2 200 jquery.min.js Show response
reconshell.com/wp-includes/js/jquery/ 87 KB
30 KB 615ms
615ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
etag: "611fea75-15db1-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2445466
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 jquery-migrate.min.js Show response
reconshell.com/wp-includes/js/jquery/ 11 KB
4 KB 387ms
387ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 3998
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "5fb4e3fe-2bd8-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 100 KB
39 KB 151ms
42ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-186158772-1

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

965cc43c2c6dbf596bc4f318aed2546daf51ff58ad8fada89ee9fdcf1007a3d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39566
x-xss-protection: 0
last-modified: Mon, 30 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 30 May 2022 18:44:14 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 191 KB
69 KB 174ms
65ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-V8R3B4G4T9

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

349bf571c2922ee8646e5b637cf862ef4c9dd4e4f3f49475162e907bfa363f8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70116
x-xss-protection: 0
expires: Mon, 30 May 2022 18:44:14 GMT

GET
H2 200 cookieconsent.min.js Show response
reconshell.com/ezoic/ 4 KB
2 KB 14ms
14ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/ezoic/cookieconsent.min.js
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:12 GMT
content-encoding: br
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "11a4-5df6193520100-gzip"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1707
expires: Tue, 30 May 2023 18:44:12 GMT

GET
H2 200 logo-favicon-white.png
reconshell.com/wp-content/uploads/2021/08/ 1 KB
2 KB 498ms
495ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2021/08/logo-favicon-white.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: e3c56335edee34422b6388701d70fdd8628590ce3065812f7b31ac847ac23184

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1512
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "611f9afe-5e4-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: image/png
cache-control: private, max-age=2447500

GET
H2 200 logo-6.png
reconshell.com/wp-content/uploads/2021/08/ 7 KB
7 KB 504ms
501ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2021/08/logo-6.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 934f8ad5b43c00dbead508fafad1104dd5c77ea9b8dc80d28545bbba94af703d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "611f9ae1-1d3b-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2447503
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 purpal.png
reconshell.com/wp-content/uploads/2022/05/ 544 KB
544 KB 1063ms
1061ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/purpal.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 634a785e24d31cf85b165dc8fb1d28827b7c726383687f1ac970a4fdbd94277b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6294451b-87fac-gzip"
response: 200
last-modified: Mon, 30 May 2022 04:16:27 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=5206
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 f4af3542f8fae0c95aaefac08a973081
secure.gravatar.com/avatar/ 1 KB
1 KB 135ms
30ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/f4af3542f8fae0c95aaefac08a973081?s=60&d=mm&r=g
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 30 May 2022 18:44:14 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="f4af3542f8fae0c95aaefac08a973081.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/f4af3542f8fae0c95aaefac08a973081?s=60&d=mm&r=g>; rel="canonical"
content-length: 1186
expires: Mon, 30 May 2022 18:49:14 GMT

GET
H2 200 01-1024x576.png
reconshell.com/wp-content/uploads/2022/05/ 18 KB
17 KB 604ms
602ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/01-1024x576.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: d521c854374aa2e5104a2f117982936b7815d534c8d4d0cac786f3a2fb4666e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62944705-49d8-gzip"
response: 200
last-modified: Mon, 30 May 2022 04:24:37 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=5157
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 ef.png
reconshell.com/wp-content/uploads/2022/05/ 75 KB
75 KB 722ms
720ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/ef.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 0d5ce86cb9b3f14fa5e6fd1e0d44f0f9f8579a6cbb1fca62e115942c8608da55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6294419f-12c80-gzip"
response: 200
last-modified: Mon, 30 May 2022 04:01:35 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=5295
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 c65-1024x357.png
reconshell.com/wp-content/uploads/2022/05/ 142 KB
141 KB 839ms
837ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/c65-1024x357.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: e21e1f9253ec97b14793e24c5491bd98351b9802e90601cad5fb65e987592b2b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "629441c8-23799-gzip"
response: 200
last-modified: Mon, 30 May 2022 04:02:16 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=5291
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 imagesloaded.min.js Show response
reconshell.com/wp-includes/js/ 5 KB
2 KB 405ms
405ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1733
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "5ee520a7-15fd-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 jquery.mp.min.js Show response
reconshell.com/wp-content/plugins/pixwell-core/assets/ 20 KB
7 KB 528ms
528ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/pixwell-core/assets/jquery.mp.min.js?ver=1.1.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: f22e1f643b9b97e06209d51252adb3d407265bf0c269d7392d318b4e1353c8fc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "607a5d05-4efd-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 jquery.isotope.min.js Show response
reconshell.com/wp-content/plugins/pixwell-core/assets/ 34 KB
9 KB 600ms
600ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/pixwell-core/assets/jquery.isotope.min.js?ver=3.0.6
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 4f62b54a19795cb378378578ab458bc1c111ef3b9043a4143224d3ddf59fef04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "607a5d05-88d7-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 rbcookie.min.js Show response
reconshell.com/wp-content/plugins/pixwell-core/assets/ 4 KB
2 KB 435ms
430ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/pixwell-core/assets/rbcookie.min.js?ver=1.0.3
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 1d3d7c7d9529dd1ff829f9c0e3d1f1352d599b8ccfbd0ca1f1bbbe4a18e241e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1552
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5d05-fc2-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 core.js Show response
reconshell.com/wp-content/plugins/pixwell-core/assets/ 15 KB
3 KB 525ms
520ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/pixwell-core/assets/core.js?ver=7.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: fa6a6fc48fd6aba0f0b7b890b526bd76982b94fd79eea7868eb67637da62992f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 3042
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5d05-3c51-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 regenerator-runtime.min.js Show response
reconshell.com/wp-includes/js/dist/vendor/ 6 KB
2 KB 474ms
469ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 2334
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "621a501b-195e-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=804464

GET
H2 200 wp-polyfill.min.js Show response
reconshell.com/wp-includes/js/dist/vendor/ 19 KB
7 KB 575ms
571ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "621a501b-4b3d-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=804464
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 index.js Show response
reconshell.com/wp-content/plugins/contact-form-7/includes/js/ 9 KB
3 KB 449ms
445ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.6.1
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 3056
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "62851ab8-25f8-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=104595

GET
H2 200 jquery.waypoints.min.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 9 KB
3 KB 474ms
469ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/jquery.waypoints.min.js?ver=3.1.1
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 66e70ec2f6169104428ff479e397e5c515deca007d206097bda23a72b8467036

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 2529
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5c76-225f-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 owl.carousel.min.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 43 KB
11 KB 666ms
662ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/owl.carousel.min.js?ver=1.8.1
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 0db80125881ba1f8798c8dccc4179650a745f6655369263e7199d6efab13c68a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "607a5c76-ad4e-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 rbsticky.min.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 6 KB
1 KB 425ms
421ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/rbsticky.min.js?ver=1.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 1b689ea107bff2003a22621ce7681945bc4f3da4a52bf63eb3ecb97d65b758e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1446
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5c76-18e6-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 jquery.tipsy.min.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 4 KB
2 KB 460ms
456ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/jquery.tipsy.min.js?ver=1.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 2c74749a433528af31be3ae74183a8a942e421f1229197da67268b20a5d09cec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1520
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5c76-1128-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 jquery.ui.totop.min.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 5 KB
1 KB 492ms
488ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/jquery.ui.totop.min.js?ver=v1.2
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: df4f4f0c20c55fa9b59c139af518439f9a951939bb7c6fb1d365898165a57474

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1373
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "607a5c76-126d-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=2592000

GET
H2 200 global.js Show response
reconshell.com/wp-content/themes/pixwell/assets/js/ 75 KB
11 KB 728ms
725ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/js/global.js?ver=7.0
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: b6950a1c217863ef667ef71bb299f0b865b34eccfb60d42db4b8dfbd9e3a553f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "607a5c76-12bba-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: application/javascript
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 comment-reply.min.js Show response
reconshell.com/wp-includes/js/ 3 KB
1 KB 512ms
508ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-includes/js/comment-reply.min.js?ver=5.9.3
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-origin-cache-control
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
content-length: 1223
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "621a501b-ba3-gzip"
vary: Accept-Encoding, Origin,Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=804464

GET
H2 200 cmbv2.js Show response
reconshell.com/detroitchicago/ 59 KB
17 KB 101ms
99ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y1f-5y21-3y2d-4y36-23y55-1y59-21&cmbcb=81&sj=x04x02x06x07x0bx0dx13x17x1fx21x2dx36x55x59&abt=LazyLoadScorer,LoadallFastAds
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5fa0e9224da54b6b277bb6beb40444de9952a907e95b0b40c8fff820cc970fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:13 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ 44 KB
44 KB 146ms
48ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700%2C800%2C300italic%2C400italic%2C600italic%2C700italic%2C800italic%7CTitillium+Web%3A600%2C700&font-display=swap&ver=1641491597

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://reconshell.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 12:16:38 GMT
x-content-type-options: nosniff
age: 23256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 12:16:38 GMT

GET
H2 200 ruby-icon.woff
reconshell.com/wp-content/themes/pixwell/assets/fonts/ 70 KB
40 KB 752ms
751ms Font
application/font-woff 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/wp-content/themes/pixwell/assets/fonts/ruby-icon.woff
Requested by: Host: reconshell.com
URL: https://reconshell.com/wp-content/themes/pixwell/assets/css/main.css?ver=7.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 3e760a4564987aa0c693e3bbc09992ac2483dc6a8624beb1a2b08b9b8718df49

Request headers

Referer: https://reconshell.com/wp-content/themes/pixwell/assets/css/main.css?ver=7.0
Origin: https://reconshell.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "607a5c76-11648-gzip"
display: staticcontent_sol
x-powered-by: PleskLin
x-ezoic-cdn: Bypass
x-middleton-display: staticcontent_sol
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
x-origin-cache-control
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/font-woff
access-control-allow-origin: https://reconshell.com
cache-control: private, max-age=2592000

GET
H2 200 NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v15/ 12 KB
12 KB 160ms
62ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v15/NaPDcZTIAOhVxoMyOr9n_E7ffBzCGItzYw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd870101ad4e95d687a2eb734707b0dd7c20808f76d7be77a71a5d13cf99401c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://reconshell.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:24:57 GMT
x-content-type-options: nosniff
age: 429557
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12136
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:39:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 May 2023 19:24:57 GMT

GET
H2 200 NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v15/ 12 KB
12 KB 161ms
65ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v15/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://reconshell.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:24 GMT
x-content-type-options: nosniff
age: 429530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11796
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 15:47:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 May 2023 19:25:24 GMT

GET
H/1.1 200
OK 1946581 Show response
ad.a-ads.com/ Frame B9E9 6 KB
2 KB 135ms
40ms Document
text/html 148.251.1.246
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.a-ads.com/1946581?size=728x90

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.246.1.251.148.clients.your-server.de

Software

nginx / Phusion Passenger(R)

Resource Hash

8c8a54567fac64ab226afc0be675b34f8d8323b668fd587623f0ea376504c9dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://reconshell.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Mon, 30 May 2022 18:44:14 GMT
Server: nginx
Status: 200 OK
Transfer-Encoding: chunked
Vary: Accept-Encoding Accept-Encoding
X-Content-Type-Options: nosniff
X-Original-Referer: https://reconshell.com/
X-Powered-By: Phusion Passenger(R)
X-XSS-Protection: 1; mode=block

GET
H2 200 AII-280x210.png
reconshell.com/wp-content/uploads/2022/03/ 49 KB
49 KB 640ms
637ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/03/AII-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 76ded50ab81767db56c3513f9c5f92d0ba1069e80b194f6cc98f15db1e0cac00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62459596-c2a2-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=520880
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 datas-280x210.jpg
reconshell.com/wp-content/uploads/2022/02/ 12 KB
10 KB 442ms
437ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/02/datas-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 8490212550b5728effa79ddb689dbcb770773e5baf1a7209c0feb7e5ac253cff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "621c708b-313b-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=790526
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 Data-Science-blogs-280x210.jpg
reconshell.com/wp-content/uploads/2022/02/ 13 KB
13 KB 563ms
559ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/02/Data-Science-blogs-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 19a698e437b8159d8b20718ea1166b8dcbdf25f799696e2b6611add29122bbf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62052293-3405-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=943255
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 dataSa-280x210.jpg
reconshell.com/wp-content/uploads/2022/01/ 7 KB
7 KB 453ms
449ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/01/dataSa-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: f6d7098cc23ce7d2fc22ab1a444d34a6d6120ed5b91ae39b17f19b8af0b16f5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "61e01602-1ca6-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=1186060
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 purpal-280x210.png
reconshell.com/wp-content/uploads/2022/05/ 98 KB
98 KB 771ms
766ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/purpal-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 1d568bea9eff50a9916fdf60542fc98f97cd5271d5fb3ef9bec1f3f803857169

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62944520-1875c-gzip"
response: 200
last-modified: Mon, 30 May 2022 04:16:32 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=5206
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 teBotnet-280x210.jpg
reconshell.com/wp-content/uploads/2022/05/ 16 KB
16 KB 591ms
587ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/teBotnet-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: a6cc16366df3f4ef93391f54e9a471f7905e279e2cbe7e4794307aabc8602414

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6293a1d0-41ac-gzip"
response: 200
last-modified: Sun, 29 May 2022 16:39:44 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=9387
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 jira-280x210.png
reconshell.com/wp-content/uploads/2022/05/ 18 KB
18 KB 646ms
642ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/jira-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: cb419523441db39662faf9f384a346191beeaf9ef32a372d8e83bbbb64b5f962

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "628e1957-48c0-gzip"
response: 200
last-modified: Wed, 25 May 2022 11:56:07 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=45648
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 VS1000-280x210.jpg
reconshell.com/wp-content/uploads/2022/05/ 20 KB
15 KB 594ms
590ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/VS1000-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: b3d5b1edeedf8c72a14d5374d03697a8b5a8c585fdd8afe1417d22769efe8936

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "628c66f5-4fa0-gzip"
response: 200
last-modified: Tue, 24 May 2022 05:02:45 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=56768
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 git2-280x210.png
reconshell.com/wp-content/uploads/2022/05/ 6 KB
6 KB 437ms
434ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/git2-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: b73d73f64887b71ee37c93cc42b937bde777d3cdbba7d32de192f540b4a77b2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6283ad71-16e7-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=113946
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 SM-280x210.jpg
reconshell.com/wp-content/uploads/2022/04/ 8 KB
8 KB 542ms
538ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/04/SM-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 2fb271bd17b1e58ec796a5663fa7711c20d9a10e44d7c901704618acc667db9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "626a8426-1f73-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=278844
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 K3S-280x210.jpg
reconshell.com/wp-content/uploads/2022/04/ 18 KB
18 KB 624ms
620ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/04/K3S-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: eb137fe4995fe18086e573e4bb2a6f6df4aa97a1ea1d4bd6c1e6b0870661bfea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6256b923-46d8-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=408559
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 lin-280x210.png
reconshell.com/wp-content/uploads/2022/04/ 4 KB
4 KB 433ms
429ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/04/lin-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: cae6c83f8af5a66d333d4add8e5e5af0e7f0b5197bd71aad6accf381725055f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62502ee6-11d0-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=451420
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 cyberde-280x210.png
reconshell.com/wp-content/uploads/2022/05/ 56 KB
56 KB 686ms
683ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/cyberde-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 8cc4e032fe02a479e0dd9f82379db244dbc2ac11db25690a53dc63ba4c838bac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6276728f-e049-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=200651
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 dfirbg-280x210.png
reconshell.com/wp-content/uploads/2022/04/ 29 KB
28 KB 572ms
569ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/04/dfirbg-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 5c149d9130b9ec651cea3a55d5b9648f7de28feb21f8e4192bede97facd35ec4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6246f263-722f-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=511951
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 USB-280x210.jpg
reconshell.com/wp-content/uploads/2022/03/ 8 KB
8 KB 444ms
441ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/03/USB-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: f38bc1cb57e20f2cc607331f3fa7d66ee19d04351ff24878f1f744bc3a9fa4aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "6241ce96-20cf-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=545636
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 cyber-vs-forensics-280x210.jpg
reconshell.com/wp-content/uploads/2022/02/ 8 KB
8 KB 465ms
463ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/02/cyber-vs-forensics-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: e7fd169c147e09ce0f525b6f460e78f7cc4e146d137ad29a45e984e149c15c9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62074f9a-1ec4-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=928995
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 db-280x210.jpg
reconshell.com/wp-content/uploads/2022/03/ 21 KB
11 KB 595ms
592ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/03/db-280x210.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: ebbd142be52020554c4152d3afe6b96f9abafc3818cf6d1c0e92ed1953eaf419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62431cf9-555d-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=537075
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 sync-280x210.png
reconshell.com/wp-content/uploads/2022/02/ 29 KB
29 KB 607ms
605ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/02/sync-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 085cdc1f2df7c4187173a9935541255451bdb74f151cce5cf3efdb890485b8d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "620f8dcd-74b5-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=874974
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 features_of_sql_server-280x210.png
reconshell.com/wp-content/uploads/2022/01/ 21 KB
20 KB 578ms
576ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/01/features_of_sql_server-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 085408db92dd613f93e500d19078baa9d574a60c2498d0d00cd7cb969431f165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "61ed3073-5264-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=1100186
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 sql-server-280x210.png
reconshell.com/wp-content/uploads/2022/01/ 36 KB
36 KB 597ms
595ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/01/sql-server-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 4bdb0b865fb578e2da7756812af59729ef9585d53ffb640ec61047834a43d16a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "61d0342e-8ffe-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=1290145
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 mys-280x210.png
reconshell.com/wp-content/uploads/2021/12/ 10 KB
10 KB 504ms
502ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2021/12/mys-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 9d84d7f58ab322c3998440d26ea49679d613ddf54be53425fdb85c19a7869a82

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "61c3561d-2940-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=1374473
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 pubads_impl_2022052401.js Show response
securepubads.g.doubleclick.net/gpt/ 365 KB
124 KB 42ms
41ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

1deb05609ea8dd3eb5c4a30b059ff80d8121b50d31ef592651bb15cda638a37d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 16:59:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6271
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126668
x-xss-protection: 0
last-modified: Tue, 24 May 2022 08:38:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 30 May 2023 16:59:43 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 96 B
109 B 95ms
28ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

6bdeca446f4587e4072046d6f6982d99c5d60f2288932d7e47ebd440071cc856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 84
x-xss-protection: 0
expires: Mon, 30 May 2022 18:44:14 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v29/ 47 KB
47 KB 58ms
26ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c0b68ea789d4bc6705f42dd6c44eb38306b965df01f9409eb4a941370e3b158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://reconshell.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 10:35:09 GMT
x-content-type-options: nosniff
age: 29345
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47924
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:51 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 30 May 2023 10:35:09 GMT

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 96ms
21ms Image
image/png 2600:9000:2315:3800:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:3800:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 07:27:28 GMT
via: 1.1 7ef588f1ad9c3a185cdaf4119943040e.cloudfront.net (CloudFront)
x-sol: middleton
age: 40606
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol
content-length: 1181
x-amz-cf-id: r9fKol6Eo0uYcXXmrAM2xnoFSvYxgMXSLSPgiRwylZvZup5663r0dA==
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "49d-5d9576f862e00-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: DUS51-P2
display: staticcontent_sol
expires: Mon, 06 Jun 2022 07:27:28 GMT

GET
H2 200 dpp-280x210.png
reconshell.com/wp-content/uploads/2022/05/ 35 KB
36 KB 585ms
584ms Image
image/png 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/dpp-280x210.png
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 6786ebfb2b98ddac0a295ce06c948d28658510e871e082f8ee4563b4ac987bde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
etag: "62904a59-8dea-gzip"
response: 200
last-modified: Fri, 27 May 2022 03:49:45 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/png
x-middleton-display: staticcontent_sol
cache-control: private, max-age=31286
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 imp.gif Show response
reconshell.com/detroitchicago/ 43 B
182 B 30ms
30ms XHR
image/gif 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A1%2C%22ad_count_adjustment%22%3A2%2C%22ad_lazyload_version%22%3A10%2C%22ad_load_version%22%3A1%2C%22ad_location_ids%22%3A%221%2C5%2C0%2C22%2C34%2C700%2C3%2C35%2C30%2C4%2C95%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A10%2C%22bidder_method%22%3A3%2C%22bidder_version%22%3A5%2C%22city%22%3A%22%22%2C%22country%22%3A%22SE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A9%2C%22domain_id%22%3A302486%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A9%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A4%2C%22page_ad_positions%22%3A%221100%2C1111%2C1113%2C1119%2C1130%2C1132%2C1133%2C1134%2C1137%2C1139%2C1140%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22bd8c39fa-b693-4f10-7011-d2f67b472501%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A189449%2C%22response_time_orig%22%3A1646%2C%22serverid%22%3A%2218.194.158.37%3A28344%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221100%2C1111%2C1113%2C1119%2C1130%2C1132%2C1133%2C1134%2C1137%2C1139%2C1140%22%2C%22t_epoch%22%3A1653936250%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A753%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: reconshell.com
URL: https://reconshell.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y1f-5y21-3y2d-4y36-23y55-1y59-21&cmbcb=81&sj=x04x02x06x07x0bx0dx13x17x1fx21x2dx36x55x59&abt=LazyLoadScorer,LoadallFastAds
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 47
expires: Sun, 29 May 2022 18:44:15 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
10 KB 73ms
21ms Script
application/javascript 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: reconshell.com
URL: https://reconshell.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y1f-5y21-3y2d-4y36-23y55-1y59-21&cmbcb=81&sj=x04x02x06x07x0bx0dx13x17x1fx21x2dx36x55x59&abt=LazyLoadScorer,LoadallFastAds
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: gzip
etag: "u2JtyZzqnTXwzBUswy2r+w=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Mon, 06 Jun 2022 18:44:14 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 cmbdv2.js Show response
reconshell.com/detroitchicago/ 46 KB
11 KB 30ms
29ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-5y0c-5y18-4y37-23y5a-21&cmbcb=81&sj=x03x0cx18x37x5a&abt=LazyLoadScorer,LoadallFastAds
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6f4cfc682737dc8d5303be9973c7d936b1d141fc4021f14cd5adcac5c54f06e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 nmash.js
reconshell.com/porpoiseant/ 29 KB
6 KB 26ms
26ms Other
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/porpoiseant/nmash.js?v=116
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 29423a53e5a231c0002fe62f9866c790fa23e62062a34939ee0cc0cd0bf24f28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "74bb-5df6193520100;5df6193520100-gzip"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 90ms
29ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 74ms
29ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 464 B
279 B 670ms
669ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=376642352382781&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=1&adks=2403869125&sfv=1-0-38&ecs=20220530&fsapi=false&prev_scp=a%3D%257C6%257C%26iid1%3D8602369829122380%26eid%3D8602369829122380%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreconshell_com-medrectangle-2-8602369829122380%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D1%26ebss%3D10061%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26br1%3D450%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2339%2C3054&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1653936254117&lmt=1653936254&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=-9&adys=-9&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=false&btvi=-1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

693273362610fc6470c1904b4d4aac8c0e8bb4f761c2dda05c325a60bf1bca32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame B3E9 6 KB
4 KB 111ms
20ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reconshell.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 30 May 2022 18:44:14 GMT
expires: Tue, 30 May 2023 18:44:14 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 456 B
271 B 401ms
401ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=1703924170272295&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=2&adks=4255985864&sfv=1-0-38&ecs=20220530&fsapi=false&prev_scp=a%3D%257C251%257C%26iid1%3D4149863359138717%26eid%3D4149863359138717%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1137%26sap%3D1137%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreconshell_com-box-2-4149863359138717%26eb_br%3D65b2c11be72ed8610e2ac0304f3023a9%26eba%3D1%26ebss%3D10061%26bv%3D22%26bvm%3D0%26bvr%3D5%26shp%3D1%26acptad%3D1%26br1%3D1900%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C1794&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1653936254179&lmt=1653936254&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=632&adys=955&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x280&msz=336x280&fws=4&ohw=1600&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=false&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

67df342829e3c4f7f189d11bbecaa6039347dd37eecabd8f0a6ba481692b2d14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 241
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 728x90
static.a-ads.com/a-ads-banners/389659/ Frame B9E9 650 KB
650 KB 78ms
21ms Image
image/gif 148.251.1.246
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.a-ads.com/a-ads-banners/389659/728x90?region=eu-central-1
Requested by: Host: ad.a-ads.com
URL: https://ad.a-ads.com/1946581?size=728x90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 148.251.1.246 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.246.1.251.148.clients.your-server.de
Software: nginx /
Resource Hash: bbf6ba424a40024326e15d65e85020fc28a62e809bfc183e61ee4a55ea3b78fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ad.a-ads.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Mon, 30 May 2022 18:44:14 GMT
Last-Modified: Wed, 18 May 2022 15:46:22 GMT
Server: nginx
x-amz-request-id: DJR89XRVP3E8SVM5
ETag: "7db6114d659dda99c4455a61cc6dc182"
Content-Type: image/gif
Cache-Control: max-age=315360000
x-amz-replication-status: COMPLETED
Content-Length: 665130
Connection: keep-alive
Accept-Ranges: bytes
x-amz-version-id: a49zRegzD.EDmLaYHWkI4c_eFvSjilAm
x-amz-id-2: 9u3B8SsfSR6409zUOiruBFDsDW6mhXNxeEB4Rd4JWda+Hmew5/QqJfm8U8yY4hxGoVO9Soic9CA=
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 40ms
7ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-186158772-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 4168
date: Mon, 30 May 2022 17:34:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 30 May 2022 19:34:46 GMT

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
429 B 46ms
10ms Script
application/javascript 2600:9000:2315:4000:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:4000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Sun, 29 May 2022 21:41:58 GMT
via: 1.1 fa544a973edca8926f95609301f23b66.cloudfront.net (CloudFront)
age: 75737
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
x-amz-cf-id: 77_Ip1M_LU_ApgQ_Gf1qCPb7RHG2XfbjSLsLw__bX2yOZCBdpWcPpQ==

POST
H2 204 collect
www.google-analytics.com/g/ 0
170 B 26ms
14ms Ping
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-V8R3B4G4T9&gtm=2oe5p1&_p=1325155601&_z=ccd.tdB&cid=1733747370.1653936254&gdid=dZTNiMT&ul=en-us&sr=1600x1200&_s=1&sid=1653936254&sct=1&seg=0&dl=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&dt=Active%20Directory%20Purple%20Teaming%20-%20Penetration%20Testing%20Tools%2C%20ML%20and%20Linux%20Tutorials&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-V8R3B4G4T9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 30 May 2022 18:44:14 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame B9E9 305 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 27ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=1325155601&t=pageview&_s=1&dl=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&ul=en-us&de=UTF-8&dt=Active%20Directory%20Purple%20Teaming%20-%20Penetration%20Testing%20Tools%2C%20ML%20and%20Linux%20Tutorials&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAAC~&jid=1297072698&gjid=1826696557&cid=1733747370.1653936254&tid=UA-186158772-1&_gid=348201785.1653936254&_r=1&gtm=2ou5p1&did=dZTNiMT&gdid=dZTNiMT&z=731424805

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://reconshell.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 30 May 2022 18:44:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=402888843;labels=Domain.reconshell_com%2CDomainId.302486;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F;uht=2;fpan=1;fpa=P0-443084315-165393625...
pixel.quantserve.com/ 35 B
372 B 554ms
178ms Image
image/gif 2600:1f1c:a99:832c:2615:337c:6c9e:c761
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=402888843;labels=Domain.reconshell_com%2CDomainId.302486;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F;uht=2;fpan=1;fpa=P0-443084315-1653936254266;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;ref=;d=reconshell.com;je=0;sr=1600x1200x24;dst=0;et=1653936254266;tzo=0;ogl=locale.en_US%2Ctype.article%2Ctitle.Active%20Directory%20Purple%20Teaming%20-%20Penetration%20Testing%20Tools%252C%20ML%20and%20Linux%20Tutori%2Cdescription.This%20repository%20is%20aimed%20at%20sharing%20the%20cliff%20notes%20for%20performing%20Red%20Teaming%20o%2Curl.https%3A%2F%2Freconshell%252Ecom%2Factive-directory-purple-teaming%2F%2Csite_name.Penetration%20Testing%20Tools%252C%20ML%20and%20Linux%20Tutorials%2Cupdated_time.2022-05-30T04%3A26%3A18%2B00%3A00%2Cimage.https%3A%2F%2Freconshell%252Ecom%2Fwp-content%2Fuploads%2F2022%2F05%2Fpurpal%252Epng%2Cimage%3Asecure_url.https%3A%2F%2Freconshell%252Ecom%2Fwp-content%2Fuploads%2F2022%2F05%2Fpurpal%252Epng%2Cimage%3Awidth.856%2Cimage%3Aheight.483%2Cimage%3Aalt.Teaming%2Cimage%3Atype.image%2Fpng%2Ctitle.Active%20Directory%20Purple%20Teaming%2Curl.https%3A%2F%2Freconshell%252Ecom%2Factive-directory-purple-teaming%2F%2Csite_name.Penetration%20Testing%20Tools%252C%20ML%20and%20Linux%20Tutorials%2Cimage.https%3A%2F%2Freconshell%252Ecom%2Fwp-content%2Fuploads%2F2022%2F05%2Fpurpal%252Epng

Requested by

Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f1c:a99:832c:2615:337c:6c9e:c761 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 30 May 2022 18:44:14 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 greenoaks.gif Show response
reconshell.com/detroitchicago/ 0
111 B 12ms
11ms XHR
text/plain 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiZDhjMzlmYS1iNjkzLTRmMTAtNzAxMS1kMmY2N2I0NzI1MDEiLCJkb21haW5faWQiOiIzMDI0ODYiLCJ0X2Vwb2NoIjoxNjUzOTM2MjUwLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiYmQ4YzM5ZmEtYjY5My00ZjEwLTcwMTEtZDJmNjdiNDcyNTAxIiwiZG9tYWluX2lkIjoiMzAyNDg2IiwidF9lcG9jaCI6MTY1MzkzNjI1MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjItMDUtMzAifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxOCJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIxIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiZDhjMzlmYS1iNjkzLTRmMTAtNzAxMS1kMmY2N2I0NzI1MDEiLCJkb21haW5faWQiOiIzMDI0ODYiLCJ0X2Vwb2NoIjoxNjUzOTM2MjUwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJiZDhjMzlmYS1iNjkzLTRmMTAtNzAxMS1kMmY2N2I0NzI1MDEiLCJkb21haW5faWQiOiIzMDI0ODYiLCJ0X2Vwb2NoIjoxNjUzOTM2MjUwLCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImJkOGMzOWZhLWI2OTMtNGYxMC03MDExLWQyZjY3YjQ3MjUwMSIsImRvbWFpbl9pZCI6IjMwMjQ4NiIsInRfZXBvY2giOjE2NTM5MzYyNTAsImRhdGEiOlt7Im5hbWUiOiJ0aW1lcl9maXJzdF9hZF9yZXF1ZXN0IiwidmFsIjoiMTc3NSJ9XX1d
Requested by: Host: reconshell.com
URL: https://reconshell.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y0b-5y0d-14y13-3y17-4y1f-5y21-3y2d-4y36-23y55-1y59-21&cmbcb=81&sj=x04x02x06x07x0bx0dx13x17x1fx21x2dx36x55x59&abt=LazyLoadScorer,LoadallFastAds
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Sun, 29 May 2022 18:44:12 GMT

GET
H2 200 houston.js Show response
reconshell.com/detroitchicago/ 4 KB
1 KB 19ms
19ms Script
application/javascript 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/detroitchicago/houston.js?gcb=0&cb=17
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3652fe22c6c2e0db8917c0a0201854e7487b13e8f689f233e78c2fd804b58ff6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:14 GMT
content-encoding: br
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1421

GET
H2 200 ls-bg.jpg
reconshell.com/wp-content/uploads/2019/08/ 23 KB
23 KB 502ms
501ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2019/08/ls-bg.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/active-directory-purple-teaming/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 6b375bb55d944a10eb9cb9d9ec182ff5886ed6b5ab7a82bec6bdeac6ae08eb3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:15 GMT
content-encoding: br
etag: "604f7abc-5b55-gzip"
response: 200
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=2592000
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 teBotnet-150x150.jpg
reconshell.com/wp-content/uploads/2022/05/ 6 KB
6 KB 377ms
377ms Image
image/jpeg 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reconshell.com/wp-content/uploads/2022/05/teBotnet-150x150.jpg
Requested by: Host: reconshell.com
URL: https://reconshell.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx / PleskLin
Resource Hash: 51cee871e5b18a7f59085afb9be9b2244453f403c957fb537f2e97aafb44899f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:15 GMT
content-encoding: br
etag: "6293a1cf-18ad-gzip"
response: 200
last-modified: Sun, 29 May 2022 16:39:43 GMT
server: nginx
display: staticcontent_sol
x-powered-by: PleskLin
x-origin-cache-control
x-ezoic-cdn: Bypass
content-type: image/jpeg
x-middleton-display: staticcontent_sol
cache-control: private, max-age=9387
x-middleton-response: 200
vary: Accept-Encoding, Origin,Accept-Encoding

GET
H2 200 dark-bottom.css
reconshell.com/ezoic/styles/ 3 KB
792 B 12ms
11ms Stylesheet
text/css 18.158.98.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://reconshell.com/ezoic/styles/dark-bottom.css
Requested by: Host: reconshell.com
URL: https://reconshell.com/ezoic/cookieconsent.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.158.98.109 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-98-109.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 94edf973e9deb80b5eccf17f8f3108eafe15209fe25fe417e8f8962a4d8f48b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/active-directory-purple-teaming/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:15 GMT
content-encoding: br
last-modified: Thu, 19 May 2022 18:31:00 GMT
server: nginx
etag: "bd7-5df6193520100-gzip"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex
content-length: 725

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 57ms
30ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022052401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7717f0b2fcbf7826b180426d0ab944abd48ae285e413f1141ff0ec286d66a6d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10514
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 167ms
31ms Script
text/javascript 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 30 May 2022 18:44:15 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E5BB 13 KB
5 KB 42ms
14ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reconshell.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 292
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 30 May 2022 18:39:23 GMT
expires: Tue, 30 May 2023 18:39:23 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 3FE1 783 B
1 KB 55ms
28ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a14d7f60a0e3db0e564e10d3bd8b1724b240f9e339be7fb0d073c95dbdc0ba0e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9pmMVxWdKQdqmqE1Z2hVMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://reconshell.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-9pmMVxWdKQdqmqE1Z2hVMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 30 May 2022 18:44:15 GMT
expires: Mon, 30 May 2022 18:44:15 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 2wSGrAFU2I9l4rVgSoL7oTdOOQiRBWDpfuX3kVoAHAw.js Show response
pagead2.googlesyndication.com/bg/ Frame E5BB 35 KB
14 KB 41ms
13ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/2wSGrAFU2I9l4rVgSoL7oTdOOQiRBWDpfuX3kVoAHAw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db0486ac0154d88f65e2b5604a82fba1374e3908910560e97ee5f7915a001c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 14:51:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13959
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13827
x-xss-protection: 0
last-modified: Tue, 24 May 2022 10:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 30 May 2023 14:51:36 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 3FE1 0
0 89ms
75ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022052401&jk=3568652441141803&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E5BB 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?YItqYA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 60ms
60ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022052401&jk=3568652441141803&bg=!jI-lj8vNAAao8wy8iPM7ACkAdvg8WosozWwaGFZqVKWJuYXoUUC3F7cyszXqPFD1co80h6yMOaQnpAIAAABJUgAAAAJoAQeZApi-X6GAlUcWHa-4rXtREqx0il3p8yRSi28cGbof9Zfv1VAyyX4D_dDFXw7LUe60BbUFPt0r31faiMSl78R7LmXW3vO1eSn4U3W6f0XV7_rZPOoO2tx4EgdTfeNb1tLxrbuBRXOstlGLHX8Pp93NxpYi3xDlObH90DPczQUoap-iYk4_qsC06W3bOE6rvIzz_UiFT-X4gTf8kq2qujUnNk5gs8RVDn4WW7vP9mFDgjzi6EejlVF1geRnJUz8Iy90RlyCIITiXZu3_2qZ6zdN7P0E-RIzWrA1eXOcbxV7abOekbSR8kS1AzSGy4mjrelFblow_u-02NYpnbV6PoY9kTEALmRi3MFxQ6S9zIQQsVNMxCjov7eXN9CLJZJ-AMBLRzRq6aT6xrNnNhw_8OUw64XSdhszuvW7Vgn172wzOMk0AM6hbQadxNj0_lvTpbpMK0dlC7NGkx7xhokLgfV2OKXsoFIUWflDcW_EHb-OqzokGiLkLhPO-IwSzBntgJrat22-j0mFIbC45kVLYqmYES5PN6mPJwaofyyvOcUPiqgqRquweP__3TvQPJ7U7TM3dZaRTSWn36RHPweHhW_5oU5zxcKctZzplcWr2pnZJMTRcGAthj-bG8zkAgIMXUUPsaxeRuYb-jCPEvWcxf08nBamZyZQTUdBd1YriHz5jLoSUKV7-NZL-_ovHVoba43G7UKoWlvKUpwkvzz3d1tV94432mwJVl4gQMuVM3ZHHaIuFfYdzoa4E_h80bazW6pB5sZUHpezawT2g-fhZM-L52TL_B2FvvOZNxCg1ugd4gt5WJ3R74qjZzXx0Qa8IENOHcek-EHilHAGvOJf1bwLO5gCjqIUosVYK8z7SFIY6kkswOemr-ySmnPF
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 31ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 32ms
17ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 439 B
265 B 437ms
436ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=3921067702602679&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=3&adks=4255985864&sfv=1-0-38&ecs=20220530&ris=3&rcs=1&fsapi=false&prev_scp=a%3D%257C251%257C%26iid1%3D4149863359138717%26eid%3D4149863359138717%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1137%26sap%3D1137%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreconshell_com-box-2-4149863359138717%26eb_br%3Dc410f2a2b0c2123f4b6651cda6c5cf53%26eba%3D1%26ebss%3D10061%26bv%3D22%26bvm%3D0%26bvr%3D5%26shp%3D1%26acptad%3D1%26br1%3D950%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C1794%26lb%3D1900%26reqt%3D1653936257614&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9-22f6c1d0a2cd0096%3AT%3D1653936254%3AS%3DALNI_MabDpExxvtCphYs9ogZ-HBU_XhJZw&abxe=1&dt=1653936257617&lmt=1653936257&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=632&adys=955&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x280&msz=336x280&fws=4&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

cf0c2ea42a81e042b28b7180aee4d6400cbf60315df15da5242dc1eaa97b1fab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 447 B
272 B 404ms
404ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=878882690640200&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=4&adks=2403869125&sfv=1-0-38&ecs=20220530&ris=4&rcs=1&fsapi=false&prev_scp=a%3D%257C6%257C%26iid1%3D8602369829122380%26eid%3D8602369829122380%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreconshell_com-medrectangle-2-8602369829122380%26eb_br%3D43aa1607a0c08c74b14a9039e7b909b4%26eba%3D1%26ebss%3D10061%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26br1%3D220%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2339%2C3054%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%26lb%3D450%26reqt%3D1653936257609&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9-22f6c1d0a2cd0096%3AT%3D1653936254%3AS%3DALNI_MabDpExxvtCphYs9ogZ-HBU_XhJZw&abxe=1&dt=1653936257621&lmt=1653936257&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=436&adys=1110&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&fws=516&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

69324c3c64b77b86f6c2d5e9ac969b23fd461e6789edb5370754e95c877ecbd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:18 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 241
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 336 B
168 B 482ms
482ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=2980568978717483&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=5&adks=4255985864&sfv=1-0-38&ecs=20220530&ris=2&rcs=2&fsapi=false&prev_scp=a%3D%257C251%257C%26iid1%3D4149863359138717%26eid%3D4149863359138717%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1137%26sap%3D1137%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreconshell_com-box-2-4149863359138717%26eb_br%3D26dfa00588543c52511429ade391f561%26eba%3D1%26ebss%3D10061%26bv%3D22%26bvm%3D0%26bvr%3D5%26shp%3D1%26acptad%3D1%26br1%3D550%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C1794%2C2339%2C3054%26lb%3D950%26reqt%3D1653936258121&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9%3AT%3D1653936254%3AS%3DALNI_MYDHdaTee3Oe0LL8-ijOIznJrMgVg&abxe=1&dt=1653936259127&lmt=1653936259&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=632&adys=955&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x280&msz=336x280&fws=4&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

b900c6a5a50a3be0b4c0e078bb313f601f49d73edbad56c25930ac3e3ccf9aba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 344 B
175 B 372ms
372ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=3262989316258893&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=6&adks=2403869125&sfv=1-0-38&ecs=20220530&ris=2&rcs=2&fsapi=false&prev_scp=a%3D%257C6%257C%26iid1%3D8602369829122380%26eid%3D8602369829122380%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreconshell_com-medrectangle-2-8602369829122380%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26ebss%3D10061%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26br1%3D120%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2339%2C3054%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%26lb%3D220%26reqt%3D1653936258125&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9%3AT%3D1653936254%3AS%3DALNI_MYDHdaTee3Oe0LL8-ijOIznJrMgVg&abxe=1&dt=1653936259139&lmt=1653936259&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=436&adys=1110&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&fws=516&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

795875899f569f42a1711cb6d2a1556175cca30ff55ba3f0f018d12ec9a3204c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 146
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://reconshell.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 17ms
17ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 14ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET ads
securepubads.g.doubleclick.net/gampad/ 0
0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 15ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=reconshell.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022052401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://reconshell.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 30 May 2022 18:44:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET ads
securepubads.g.doubleclick.net/gampad/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=1081318899208233&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=7&adks=4255985864&sfv=1-0-38&ecs=20220530&ris=1&rcs=3&fsapi=false&prev_scp=a%3D%257C251%257C%26iid1%3D4149863359138717%26eid%3D4149863359138717%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1137%26sap%3D1137%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreconshell_com-box-2-4149863359138717%26eb_br%3D8de2c8ca79e8623e3cb37120a35ebaa2%26eba%3D1%26ebss%3D10061%26bv%3D22%26bvm%3D0%26bvr%3D5%26shp%3D1%26acptad%3D1%26br1%3D240%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C919%2C1794%2C2339%2C3054%2C20%2C2310%2C2339%2C2526%2C2527%2C2763%2C2764%2C2765%2C3054%2C3154%26lb%3D550%26reqt%3D1653936259629&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9%3AT%3D1653936254%3AS%3DALNI_MYDHdaTee3Oe0LL8-ijOIznJrMgVg&abxe=1&dt=1653936259634&lmt=1653936259&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=632&adys=955&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x280&msz=336x280&fws=4&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Domain: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3568652441141803&correlator=1427791959940706&eid=44761477%2C21065725&output=ldjh&gdfp_req=1&vrg=2022052401&ptt=17&impl=fifs&iu_parts=1254144%3A22642776669%2Creconshell_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=8&adks=2403869125&sfv=1-0-38&ecs=20220530&ris=1&rcs=3&fsapi=false&prev_scp=a%3D%257C6%257C%26iid1%3D8602369829122380%26eid%3D8602369829122380%26t%3D134%26d%3D302486%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod88%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreconshell_com-medrectangle-2-8602369829122380%26eb_br%3D8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26ebss%3D10061%26bv%3D4%26bvm%3D0%26bvr%3D4%26shp%3D1%26br1%3D36%26br2%3D160%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C14%2C0%2C192%2C0%2C168%2C192%2C20%2C71%2C197%2C192%2C31%2C902%2C903%2C901%2C902%2C903%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C1794%2C2339%2C3054%2C20%2C2310%2C2526%2C2527%2C2763%2C2764%2C2765%2C3154%2C17%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3154%2C17%2C19%2C20%2C2310%2C2351%2C2526%2C2527%2C2610%2C2688%2C2693%2C2761%2C2763%2C2764%2C2765%2C3044%2C3045%2C3053%2C3154%26lb%3D120%26reqt%3D1653936259654&eri=1&sc=1&cookie=ID%3D72ccc68ad18a9be9%3AT%3D1653936254%3AS%3DALNI_MYDHdaTee3Oe0LL8-ijOIznJrMgVg&abxe=1&dt=1653936259658&lmt=1653936259&dlt=1653936252800&idt=1279&biw=1600&bih=1200&adxs=436&adys=1110&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Freconshell.com%2Factive-directory-purple-teaming%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&fws=516&ohw=1600&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1733747370.1653936254&ga_sid=1653936254&ga_hid=1325155601&ga_fc=true&btvi=0

Verdicts & Comments Add Verdict or Comment

244 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
reconshell.com/	1970-01-20 03:27:02	Name: pvc_visits[0] Value: 1654022651b8841
.reconshell.com/	1970-01-20 03:25:38	Name: ezoadgid_302486 Value: -1
.reconshell.com/	1970-01-20 03:25:43	Name: ezoref_302486 Value:
.reconshell.com/	1970-01-20 12:11:12	Name: ezosuibasgeneris-1 Value: 555870cf-c29c-45d4-5e2c-2c9d19432023
.reconshell.com/	1970-01-20 03:25:43	Name: ezoab_302486 Value: mod88
.reconshell.com/	1970-01-20 03:28:29	Name: active_template::302486 Value: pub_site.1653936250
.reconshell.com/	1970-01-20 03:25:38	Name: ezopvc_302486 Value: 1
.reconshell.com/	1970-01-20 03:27:02	Name: ezepvv Value: 291
.reconshell.com/	1970-01-20 03:25:38	Name: ezovid_302486 Value: 1806097635
.reconshell.com/	1970-01-20 03:25:38	Name: lp_302486 Value: https://reconshell.com/active-directory-purple-teaming/
.reconshell.com/	1970-01-20 03:28:29	Name: ezovuuidtime_302486 Value: 1653936252
.reconshell.com/	1970-01-20 03:25:38	Name: ezovuuid_302486 Value: e5b3e5da-2f10-41d3-635a-ba9135f27d2a
reconshell.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
reconshell.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.reconshell.com/	1970-01-20 20:56:48	Name: _ga_V8R3B4G4T9 Value: GS1.1.1653936254.1.0.1653936254.0
.reconshell.com/	1970-01-20 20:56:48	Name: _ga Value: GA1.2.1733747370.1653936254
.reconshell.com/	1970-01-20 03:27:02	Name: _gid Value: GA1.2.348201785.1653936254
.reconshell.com/	1970-01-20 03:25:36	Name: _gat_gtag_UA_186158772_1 Value: 1
reconshell.com/	1970-01-22 16:44:48	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
reconshell.com/	1970-01-22 16:44:48	Name: ezohw Value: w%3D1600%2Ch%3D1200
.quantserve.com/	1970-01-20 12:55:50	Name: mc Value: 6295107e-b436b-01562-2bc01
.reconshell.com/	1970-01-20 12:50:05	Name: __qca Value: P0-443084315-1653936254266
reconshell.com/	1970-01-20 12:11:12	Name: ezux_lpl_302486 Value: 1653936255200\|bd8c39fa-b693-4f10-7011-d2f67b472501\|false
reconshell.com/	1970-01-20 04:08:48	Name: _pbjs_userid_consent_data Value: 3524755945110770
.reconshell.com/	1970-01-20 12:47:12	Name: __gads Value: ID=72ccc68ad18a9be9:T=1653936254:S=ALNI_MYDHdaTee3Oe0LL8-ijOIznJrMgVg
.doubleclick.net/	1970-01-20 12:47:12	Name: IDE Value: AHWqTUmsq4SLxCO-77iNSuFCPeXtGhpjG5m62l6RMtbfG5y4wGCp8tzlydLEpuNnsBg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

50ff326c4473f397d95e34502f4b598d.safeframe.googlesyndication.com
ad.a-ads.com
adservice.google.com
adservice.google.de
fonts.googleapis.com
fonts.gstatic.com
go.ezodn.com
go.ezoic.net
pagead2.googlesyndication.com
pixel.quantserve.com
reconshell.com
rules.quantcount.com
secure.gravatar.com
secure.quantserve.com
securepubads.g.doubleclick.net
static.a-ads.com
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
securepubads.g.doubleclick.net
142.250.185.194
148.251.1.246
18.158.98.109
2600:1f1c:a99:832c:2615:337c:6c9e:c761
2600:9000:2315:3800:2:cb38:840:93a1
2600:9000:2315:4000:6:44e3:f8c0:93a1
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:800::2008
2a00:1450:4001:808::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:810::2001
2a00:1450:4001:811::2002
2a00:1450:4001:812::2001
2a00:1450:4001:813::2002
2a00:1450:4001:813::200a
2a00:1450:4001:829::2004
2a00:1450:4001:82b::2002
2a00:1450:4001:831::2002
2a04:fa87:fffe::c000:4902
2a06:98c1:3120::3
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
085408db92dd613f93e500d19078baa9d574a60c2498d0d00cd7cb969431f165
085cdc1f2df7c4187173a9935541255451bdb74f151cce5cf3efdb890485b8d1
0d5ce86cb9b3f14fa5e6fd1e0d44f0f9f8579a6cbb1fca62e115942c8608da55
0db80125881ba1f8798c8dccc4179650a745f6655369263e7199d6efab13c68a
10d4b728888654e0b85c706a9310b551087d3321fb8ebfff147d07b13fa73bf0
19a698e437b8159d8b20718ea1166b8dcbdf25f799696e2b6611add29122bbf5
1a2607e7e1cf536e8bbf0c90c0165e4d6e00e55ce7d8df109c7c2267bec64ca3
1b689ea107bff2003a22621ce7681945bc4f3da4a52bf63eb3ecb97d65b758e7
1d3d7c7d9529dd1ff829f9c0e3d1f1352d599b8ccfbd0ca1f1bbbe4a18e241e2
1d568bea9eff50a9916fdf60542fc98f97cd5271d5fb3ef9bec1f3f803857169
1deb05609ea8dd3eb5c4a30b059ff80d8121b50d31ef592651bb15cda638a37d
29423a53e5a231c0002fe62f9866c790fa23e62062a34939ee0cc0cd0bf24f28
2c74749a433528af31be3ae74183a8a942e421f1229197da67268b20a5d09cec
2fb271bd17b1e58ec796a5663fa7711c20d9a10e44d7c901704618acc667db9a
349bf571c2922ee8646e5b637cf862ef4c9dd4e4f3f49475162e907bfa363f8c
3652fe22c6c2e0db8917c0a0201854e7487b13e8f689f233e78c2fd804b58ff6
3c0b68ea789d4bc6705f42dd6c44eb38306b965df01f9409eb4a941370e3b158
3e760a4564987aa0c693e3bbc09992ac2483dc6a8624beb1a2b08b9b8718df49
4bdb0b865fb578e2da7756812af59729ef9585d53ffb640ec61047834a43d16a
4f62b54a19795cb378378578ab458bc1c111ef3b9043a4143224d3ddf59fef04
51cee871e5b18a7f59085afb9be9b2244453f403c957fb537f2e97aafb44899f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5c12aeb1ff990a6bc269f96a8e21dd0585d27dcc478f61eb70357d03352619be
5c149d9130b9ec651cea3a55d5b9648f7de28feb21f8e4192bede97facd35ec4
5cbf31f01d7d1ce4853bcd6cc64dbfd103d412ec14d8bcc4ebca3b35dc3f3b74
5fa0e9224da54b6b277bb6beb40444de9952a907e95b0b40c8fff820cc970fa7
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
634a785e24d31cf85b165dc8fb1d28827b7c726383687f1ac970a4fdbd94277b
66e70ec2f6169104428ff479e397e5c515deca007d206097bda23a72b8467036
6786ebfb2b98ddac0a295ce06c948d28658510e871e082f8ee4563b4ac987bde
679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78
67df342829e3c4f7f189d11bbecaa6039347dd37eecabd8f0a6ba481692b2d14
69324c3c64b77b86f6c2d5e9ac969b23fd461e6789edb5370754e95c877ecbd4
693273362610fc6470c1904b4d4aac8c0e8bb4f761c2dda05c325a60bf1bca32
6b375bb55d944a10eb9cb9d9ec182ff5886ed6b5ab7a82bec6bdeac6ae08eb3f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bdeca446f4587e4072046d6f6982d99c5d60f2288932d7e47ebd440071cc856
6f4cfc682737dc8d5303be9973c7d936b1d141fc4021f14cd5adcac5c54f06e0
73a51de126bf715562b4774f08560b78d2d1f6f474b575a43a517e12d45fba5a
76ded50ab81767db56c3513f9c5f92d0ba1069e80b194f6cc98f15db1e0cac00
7717f0b2fcbf7826b180426d0ab944abd48ae285e413f1141ff0ec286d66a6d8
795875899f569f42a1711cb6d2a1556175cca30ff55ba3f0f018d12ec9a3204c
81e1cfa3d7d84ee85ec93158371e929dbc067311b76d83a053d4f377f5608da1
8490212550b5728effa79ddb689dbcb770773e5baf1a7209c0feb7e5ac253cff
874e5cb8757149fb23cff7ad37bdca20efbe22dc81ed2e24da4afc3d9928db72
8c8a54567fac64ab226afc0be675b34f8d8323b668fd587623f0ea376504c9dc
8cc4e032fe02a479e0dd9f82379db244dbc2ac11db25690a53dc63ba4c838bac
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
934f8ad5b43c00dbead508fafad1104dd5c77ea9b8dc80d28545bbba94af703d
93bb2c7479294f878b3c23c97f7c5393d73af10322a88dd71059645ac6fd14f7
94edf973e9deb80b5eccf17f8f3108eafe15209fe25fe417e8f8962a4d8f48b3
95347f5a02237a0ff92fc87be7ad78f0fb44eebc125ffb61edc17da98a6d23d7
955442a1f4c09093797504c109ac6148da8c87a8d449197508aed99efd65b5f2
965cc43c2c6dbf596bc4f318aed2546daf51ff58ad8fada89ee9fdcf1007a3d1
9d84d7f58ab322c3998440d26ea49679d613ddf54be53425fdb85c19a7869a82
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
a14d7f60a0e3db0e564e10d3bd8b1724b240f9e339be7fb0d073c95dbdc0ba0e
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
a6cc16366df3f4ef93391f54e9a471f7905e279e2cbe7e4794307aabc8602414
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
b3d5b1edeedf8c72a14d5374d03697a8b5a8c585fdd8afe1417d22769efe8936
b6950a1c217863ef667ef71bb299f0b865b34eccfb60d42db4b8dfbd9e3a553f
b73d73f64887b71ee37c93cc42b937bde777d3cdbba7d32de192f540b4a77b2f
b900c6a5a50a3be0b4c0e078bb313f601f49d73edbad56c25930ac3e3ccf9aba
bbf6ba424a40024326e15d65e85020fc28a62e809bfc183e61ee4a55ea3b78fb
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bf7299d2d2190861f97423878c241772cbf52460f8d93f7d0594ddd6fb2f75ed
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cae6c83f8af5a66d333d4add8e5e5af0e7f0b5197bd71aad6accf381725055f8
cb419523441db39662faf9f384a346191beeaf9ef32a372d8e83bbbb64b5f962
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
cf0c2ea42a81e042b28b7180aee4d6400cbf60315df15da5242dc1eaa97b1fab
d521c854374aa2e5104a2f117982936b7815d534c8d4d0cac786f3a2fb4666e1
d5c1172f24f4f49f780c65cf5be897527fd08f3662a2ba8db0cfe0057d92e367
db0486ac0154d88f65e2b5604a82fba1374e3908910560e97ee5f7915a001c0c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd870101ad4e95d687a2eb734707b0dd7c20808f76d7be77a71a5d13cf99401c
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df4f4f0c20c55fa9b59c139af518439f9a951939bb7c6fb1d365898165a57474
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e21e1f9253ec97b14793e24c5491bd98351b9802e90601cad5fb65e987592b2b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c56335edee34422b6388701d70fdd8628590ce3065812f7b31ac847ac23184
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e7fd169c147e09ce0f525b6f460e78f7cc4e146d137ad29a45e984e149c15c9b
eb137fe4995fe18086e573e4bb2a6f6df4aa97a1ea1d4bd6c1e6b0870661bfea
ebbd142be52020554c4152d3afe6b96f9abafc3818cf6d1c0e92ed1953eaf419
ec0cf8e63b250cf3e74918dac833ab7fe10123ee4239015bb14bc0758c96cfe4
f22e1f643b9b97e06209d51252adb3d407265bf0c269d7392d318b4e1353c8fc
f38bc1cb57e20f2cc607331f3fa7d66ee19d04351ff24878f1f744bc3a9fa4aa
f46d96d805c7e9e467422dfe516c43edb4632c0273cea26722fee7ba885f869e
f6d7098cc23ce7d2fc22ab1a444d34a6d6120ed5b91ae39b17f19b8af0b16f5b
fa6a6fc48fd6aba0f0b7b890b526bd76982b94fd79eea7868eb67637da62992f
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

reconshell.com Open in urlscan Pro 18.158.98.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

115 Requests

98 %HTTPS

85 %IPv6

15 Domains

20 Subdomains

21 IPs

3 Countries

2865 kBTransfer

4878 kBSize

26 Cookies

15 Outgoing links

Redirected requests

115 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

reconshell.com Open in urlscan Pro
18.158.98.109 Public Scan

Screenshot
Live screenshot

Full Image

115
Requests

98 %
HTTPS

85 %
IPv6

15
Domains

20
Subdomains

21
IPs

3
Countries

2865 kB
Transfer

4878 kB
Size

26
Cookies

115 HTTP transactions
2 data transactions