ghostsec.writeas.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2001:4800:7810:512:500b:b07c:ff05:8178, located in United States and belongs to RMH-14, US. The main domain is ghostsec.writeas.com.
TLS certificate: Issued by R3 on December 28th 2020. Valid for: 3 months.

This is the only time ghostsec.writeas.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2001:4800:781... 2001:4800:7810:512:500b:b07c:ff05:8178	33070 (RMH-14) (RMH-14)
6	2600:9000:21b... 2600:9000:21b3:f200:11:e3d9:3f40:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2

1 2001:4800:7810:512:500b:b07c:ff05:8178 (United States)

ASN33070 (RMH-14, US)

ghostsec.writeas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:21b3:f200:11:e3d9:3f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.writeas.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	writeas.net cdn.writeas.net	159 KB
1	writeas.com ghostsec.writeas.com	16 KB
7	2

	Domain	Requested by
6	cdn.writeas.net	ghostsec.writeas.com cdn.writeas.net
1	ghostsec.writeas.com
7	2

This site contains links to these domains. Also see Links.

Domain
github.com
www.youtube.com
twitter.com
www.darkowl.com
ginosblog.com
write.as

Subject Issuer	Validity	Valid
*.writeas.com R3	`2020-12-28` - `2021-03-28`	3 months	crt.sh
cdn.writeas.net Amazon	`2020-10-28` - `2021-11-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ghostsec.writeas.com/introduction-to-ghostsec
Frame ID: 105777BBA5E643F600881101E44190BF
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Go (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /^Caddy$/i

Caddy (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^Caddy$/i

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

175 kB
Transfer

237 kB
Size

1
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/ghostsec420/Opchildsafepart2
Title: inside of it.

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=aD0WfgngGAE
Title: youtube video

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=HMj7AJh-WR4
Title: video

Search URL Search Domain Scan URL

URL: https://twitter.com/Anonleb3/status/1292943542478753792
Title: hacker group

Search URL Search Domain Scan URL

URL: https://www.darkowl.com/blog-content/daniel-hosting-goes-dark-for-good
Title: An article

Search URL Search Domain Scan URL

URL: https://ginosblog.com/ghostsecs-oplebanon-over-100-govt-usernames-and-passwords-dumped-online-79bb36854843
Title: DarkOwl analysts,

Search URL Search Domain Scan URL

URL: https://twitter.com/SebastianDAlex
Title: @SebastianDAlex,

Search URL Search Domain Scan URL

URL: https://twitter.com/_GhostSec_
Title: https://twitter.com/_GhostSec_

Search URL Search Domain Scan URL

URL: https://write.as/
Title: write.as

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request introduction-to-ghostsec Show response ghostsec.writeas.com/	16 KB 16 KB	449ms 174ms	Document text/html	2001:4800:7810:512:500b:b07c:ff05:8178 RMH-14
General Check archive.org Show headers Download Go to Full URL https://ghostsec.writeas.com/introduction-to-ghostsec Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2001:4800:7810:512:500b:b07c:ff05:8178 , United States, ASN33070 (RMH-14, US), Reverse DNS Software Caddy / Resource Hash `f6a0d644398dccbaf6e7d330a0a1ee60565ac97a04a74827c9ae0f9b163adde1` Request headers :method GET :authority ghostsec.writeas.com :scheme https :path /introduction-to-ghostsec pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html; charset=utf-8 date Sat, 20 Feb 2021 00:02:19 GMT server Caddy set-cookie u=MTYxMzc3OTMzOXxOME4yZHprbURFdWJHNVRlOGlUcTF6aE8taHViMUl2RTdWWXJIQU9vS2RXOUNqbXV8CTdlNFN4awGsPqATp36zEaSZ-YetDale54GMgMKwqhM=; Path=/; Expires=Thu, 19 Aug 2021 00:02:19 GMT; Max-Age=15552000; HttpOnly; Secure
GET H2	200	write.b1eee5ac8aba9afdc8e24.css cdn.writeas.net/css/	77 KB 14 KB	164ms 27ms	Stylesheet text/css	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/css/write.b1eee5ac8aba9afdc8e24.css Requested by Host: ghostsec.writeas.com URL: https://ghostsec.writeas.com/introduction-to-ghostsec Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `a23e0b1fefde1e25f86b270aa9198d2b88a9145519926ae50bc0a2245a423301` Request headers Referer https://ghostsec.writeas.com/introduction-to-ghostsec User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 05 Feb 2021 17:40:56 GMT content-encoding br last-modified Fri, 05 Feb 2021 17:40:10 GMT server nginx age 1232444 etag W/"601d82fa-13462" vary Accept-Encoding,Accept-Encoding x-cache Hit from cloudfront content-type text/css access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 x-amz-cf-id NjHfwvtHbdbCQwd4Elarm0RjVdUjUCyD3mjYmLrvtI92UqPCTeIFRA== via 1.1 c176cabe132d03e00f152d5649d68e96.cloudfront.net (CloudFront) expires Mon, 31 Jan 2022 17:40:56 GMT
GET H2	200	localdate.js Show response cdn.writeas.net/js/	697 B 1 KB	48ms 28ms	Script application/x-javascript	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/js/localdate.js Requested by Host: ghostsec.writeas.com URL: https://ghostsec.writeas.com/introduction-to-ghostsec Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `432281499e611a248cd062f5c4405969c514b4b611c3ebc6ed62d32de1324320` Request headers Referer https://ghostsec.writeas.com/introduction-to-ghostsec User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 11 Nov 2020 06:17:56 GMT via 1.1 c176cabe132d03e00f152d5649d68e96.cloudfront.net (CloudFront) age 8703824 x-cache Hit from cloudfront content-length 697 last-modified Thu, 05 Nov 2020 21:29:25 GMT server nginx etag "5fa46eb5-2b9" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 accept-ranges bytes x-amz-cf-id n6FHOLAhaStEKwri1NCSisq8-m0Gn0ciXze_QHpI-v6WB39WEKZ4Tg== expires Sat, 06 Nov 2021 06:17:56 GMT
GET H2	200	webfont.js Show response cdn.writeas.net/js/	12 KB 13 KB	41ms 40ms	Script application/x-javascript	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/js/webfont.js Requested by Host: ghostsec.writeas.com URL: https://ghostsec.writeas.com/introduction-to-ghostsec Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `2711b037e078e306e59765e9fc22d9f86867eb26af8c6af72d864a1c52bed8ac` Request headers Referer https://ghostsec.writeas.com/introduction-to-ghostsec User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 27 Oct 2020 17:47:39 GMT via 1.1 c176cabe132d03e00f152d5649d68e96.cloudfront.net (CloudFront) age 9958441 x-cache Hit from cloudfront content-length 12493 last-modified Tue, 27 Oct 2020 15:59:32 GMT server nginx etag "5f9843e4-30cd" vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 accept-ranges bytes x-amz-cf-id a66C7-RIPrNY6DTjYtdx3-n6Bw2exSg4IYkuooKEroEzeDPmcpTcLA== expires Fri, 22 Oct 2021 17:47:39 GMT
GET H2	200	fonts.4ce1882.css cdn.writeas.net/css/	2 KB 771 B	26ms 25ms	Stylesheet text/css	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/css/fonts.4ce1882.css Requested by Host: cdn.writeas.net URL: https://cdn.writeas.net/js/webfont.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `b1119cb35793ecd895e0cd5f1a2894fa14994c703412a9b5c8c229abcdd1ffb8` Request headers Referer https://ghostsec.writeas.com/introduction-to-ghostsec User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 16 Nov 2020 01:39:41 GMT content-encoding gzip last-modified Sat, 14 Nov 2020 15:22:23 GMT server nginx age 8288519 etag W/"5faff62f-7b1" vary Accept-Encoding,Accept-Encoding x-cache Hit from cloudfront content-type text/css access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 x-amz-cf-id PAXPGr30nvo0fQGc3euAm0tIzowIoyF1QeKK-NUaYHNY2PUWQK1Eig== via 1.1 c176cabe132d03e00f152d5649d68e96.cloudfront.net (CloudFront) expires Thu, 11 Nov 2021 01:39:41 GMT
GET H2	200	Lora-Bold.woff2 cdn.writeas.net/fonts/	67 KB 68 KB	80ms 29ms	Font application/octet-stream	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/fonts/Lora-Bold.woff2 Requested by Host: cdn.writeas.net URL: https://cdn.writeas.net/css/fonts.4ce1882.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `5aad84fd548b01f6f96d44b6254b68a247e5d12800b5284c72a5310d05746ee5` Request headers Origin https://ghostsec.writeas.com Referer https://cdn.writeas.net/css/fonts.4ce1882.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 27 Oct 2020 17:47:40 GMT via 1.1 839063342624c89d4f9d50b54d1d62dd.cloudfront.net (CloudFront) last-modified Tue, 27 Oct 2020 15:59:32 GMT server nginx age 9958440 etag "5f9843e4-10c30" x-cache Hit from cloudfront content-type application/octet-stream access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 accept-ranges bytes content-length 68656 x-amz-cf-id dnfbuy4DAe1qzB8WgpbSuXUgK6Bqj_LunJf1XAXoB_O9q5QLm6dOEw== expires Fri, 22 Oct 2021 17:47:40 GMT
GET H2	200	Lora-Regular.woff2 cdn.writeas.net/fonts/	62 KB 63 KB	109ms 62ms	Font application/octet-stream	2600:9000:21b3:f200:11:e3d9:3f40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.writeas.net/fonts/Lora-Regular.woff2 Requested by Host: cdn.writeas.net URL: https://cdn.writeas.net/css/fonts.4ce1882.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21b3:f200:11:e3d9:3f40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash `26ee6f80607aa285386fc2132073fda3639fddfb3c139d7e92490de306d2b8d1` Request headers Origin https://ghostsec.writeas.com Referer https://cdn.writeas.net/css/fonts.4ce1882.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 27 Oct 2020 17:47:40 GMT via 1.1 839063342624c89d4f9d50b54d1d62dd.cloudfront.net (CloudFront) last-modified Tue, 27 Oct 2020 15:59:32 GMT server nginx age 9958440 etag "5f9843e4-f8b4" x-cache Hit from cloudfront content-type application/octet-stream access-control-allow-origin * cache-control max-age=31104000 x-amz-cf-pop LHR62-C3 accept-ranges bytes content-length 63668 x-amz-cf-id 7xCokTxHAwWrAXDVHC-i5p2k48AB5CDSyjaZ1fQS438_FcPYdnuBCg== expires Fri, 22 Oct 2021 17:47:40 GMT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ghostsec.writeas.com/	1970-01-19 20:35:31	Name: u Value: MTYxMzc3OTMzOXxOME4yZHprbURFdWJHNVRlOGlUcTF6aE8taHViMUl2RTdWWXJIQU9vS2RXOUNqbXV8CTdlNFN4awGsPqATp36zEaSZ-YetDale54GMgMKwqhM=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.writeas.net
ghostsec.writeas.com
2001:4800:7810:512:500b:b07c:ff05:8178
2600:9000:21b3:f200:11:e3d9:3f40:93a1
26ee6f80607aa285386fc2132073fda3639fddfb3c139d7e92490de306d2b8d1
2711b037e078e306e59765e9fc22d9f86867eb26af8c6af72d864a1c52bed8ac
432281499e611a248cd062f5c4405969c514b4b611c3ebc6ed62d32de1324320
5aad84fd548b01f6f96d44b6254b68a247e5d12800b5284c72a5310d05746ee5
a23e0b1fefde1e25f86b270aa9198d2b88a9145519926ae50bc0a2245a423301
b1119cb35793ecd895e0cd5f1a2894fa14994c703412a9b5c8c229abcdd1ffb8
f6a0d644398dccbaf6e7d330a0a1ee60565ac97a04a74827c9ae0f9b163adde1

ghostsec.writeas.com Open in urlscan Pro 2001:4800:7810:512:500b:b07c:ff05:8178 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

175 kBTransfer

237 kBSize

1 Cookies

9 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

1 Cookies

Indicators

ghostsec.writeas.com Open in urlscan Pro
2001:4800:7810:512:500b:b07c:ff05:8178 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

175 kB
Transfer

237 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions