urlscan.io logo urlscan.io
SecurityTrails logo

bismilbooks.com Open in urlscan Pro
2606:4700:3033::681b:b508  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lamborge.changeip.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-...
Effective URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-...
Submission: On February 23 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 5 countries across 8 domains to perform 32 HTTP transactions. The main IP is 2606:4700:3033::681b:b508, located in United States and belongs to CLOUDFLARENET, US. The main domain is bismilbooks.com.
This is the only time bismilbooks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    107.152.35.251 (United States)

ASN11878 (TZULO, US)
lamborge.changeip.com
18    2606:4700:3033::681b:b508 (United States)

ASN13335 (CLOUDFLARENET, US)
bismilbooks.com
5    2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    46.166.179.121 (Netherlands)

ASN43350 (NFORCE, NL)
PTR: ptr9.adreactor.com
adserver.adreactor.com
3    2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2606:4700:3035::681c:78b (United States)

ASN13335 (CLOUDFLARENET, US)
readlibs.com
1    46.105.201.240 (France)

ASN16276 (OVH, FR)
s10.histats.com
1    158.69.251.190 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns546644.ip-158-69-251.net
s4.histats.com
Domain Requested by
18 bismilbooks.com bismilbooks.com
5 maxcdn.bootstrapcdn.com bismilbooks.com
3 fonts.gstatic.com bismilbooks.com
2 readlibs.com 1 redirects bismilbooks.com
1 s4.histats.com s10.histats.com
1 s10.histats.com bismilbooks.com
1 adserver.adreactor.com bismilbooks.com
1 ajax.googleapis.com bismilbooks.com
1 fonts.googleapis.com bismilbooks.com
1 lamborge.changeip.com 1 redirects
32 10

This site contains links to these domains. Also see Links.

Domain
look.udncoeln.com
adserver.adreactor.com
www.amazon.com
Subject Issuer Validity Valid
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
*.storage.googleapis.com
GTS CA 1O1		 2020-02-12 -
2020-05-06		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-02-12 -
2020-05-06		 3 months crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-01-31 -
2020-10-09		 8 months crt.sh

This page contains 1 frames:

Primary Page: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Frame ID: 6BC90F2F3A4716ADA15FED8DA0F53E55
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://lamborge.changeip.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-conden... HTTP 302
    http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-conden... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /react.*\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

32
Requests

34 %
HTTPS

60 %
IPv6

8
Domains

10
Subdomains

9
IPs

5
Countries

494 kB
Transfer

760 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lamborge.changeip.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf HTTP 302
    http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28
  • http://readlibs.com/bls/sprite.png HTTP 301
  • https://readlibs.com/bls/sprite.png

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set 1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
bismilbooks.com/
Redirect Chain
  • http://lamborge.changeip.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
  • http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
33 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
239781a075b6999a96ff28635c887a325d2153b9d4ebbd4f66c13a17673dedbc

Request headers

Host
bismilbooks.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=dd48f11b1de8d55c38920d05d688a72921582448728; expires=Tue, 24-Mar-20 09:05:28 GMT; path=/; domain=.bismilbooks.com; HttpOnly; SameSite=Lax
Vary
Accept-Encoding
Cache-Control
max-age=14400
CF-Cache-Status
MISS
Server
cloudflare
CF-RAY
569809c7fd1326ee-FRA
Content-Encoding
gzip

Redirect headers

Date
Sun, 23 Feb 2020 09:05:27 GMT
Server
Apache/2.4.18 (Ubuntu)
location
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Content-Length
4
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.2/css/ 		114 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.2/css/bootstrap.min.css
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
d31bef450ee67b64f9b70bfdf41fe4e00c65438705cc1fbb48ea6026d3a5d697

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Sun, 23 Feb 2020 09:05:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin
*
etag
"1544639647"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
19209
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Sun, 23 Feb 2020 09:05:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:19 GMT
access-control-allow-origin
*
etag
"1544639719"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
5041
css
fonts.googleapis.com/ 		27 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700%7CPT+Sans+Narrow%7CSource+Sans+Pro:200,300,400,600,700,900&subset=all
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f64e02e8aa2664534b53be9498b14529fbc4223ec67397137d4280ae59fd46bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 23 Feb 2020 09:05:28 GMT
server
ESF
date
Sun, 23 Feb 2020 09:05:28 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 23 Feb 2020 09:05:28 GMT
style.css
bismilbooks.com/css/ 		13 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://bismilbooks.com/css/style.css
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45f9afb06cf04e34138ce99e3fed860d538486e8eb6b3c63971eb553cc6b9436

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Thu, 31 Jan 2019 12:26:16 GMT
Server
cloudflare
Age
2606
ETag
"32c7-580c021ff2a00-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809c98e0c26ee-FRA
Content-Length
3543
coment.css
bismilbooks.com/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://bismilbooks.com/css/coment.css
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
681024f4a15d2c67834384cf97a7302855bb39c1136366ecd975dbf9d2992d19

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
Content-Encoding
gzip
CF-Cache-Status
EXPIRED
Last-Modified
Thu, 20 Jul 2017 15:45:12 GMT
Server
cloudflare
ETag
"6e9-554c1a24e1200-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809c99aa01f39-FRA
Content-Length
733
1726273989_500.jpg
bismilbooks.com/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/1726273989_500.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58b0aa6d6b75d542b4950b5c4647add54b61d8f69fab4fab3ab41a3f4d916e4d

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
CF-Cache-Status
MISS
Server
cloudflare
Vary
Accept-Encoding
Content-Type
image/jpg
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809c998f8bebf-FRA
korryn-mcminn.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/korryn-mcminn.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17d3160251567bf6b7233b0bc7932e5190c581c2aac8530370496e8e9df922fe

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:50 GMT
Server
cloudflare
ETag
"792-554c1ba071180"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809c99e3196e6-FRA
Content-Length
1938
tara-leigh.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/tara-leigh.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b48dc4df31a155b47f0e155d90b022f2a7090aec7367eb25242818b643905b10

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:52:26 GMT
Server
cloudflare
ETag
"76c-554c1bc2c6280"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cafe791f39-FRA
Content-Length
1900
kate-desjardins.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/kate-desjardins.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
308c941f3d8a0adf7e96a573dab73218e6a98d121a9ce85c7316402deefda362

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:36 GMT
Server
cloudflare
ETag
"7c3-554c1b9317200"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cafee026ee-FRA
Content-Length
1987
lauren-armstrong.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/lauren-armstrong.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
597e53b79ff4deb1fc7df091b2d9f00e174312bb061aca8dd5ec188a38ea2c47

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:58 GMT
Server
cloudflare
ETag
"81e-554c1ba812380"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cb0f3ddfa5-FRA
Content-Length
2078
kirsty-watson.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/kirsty-watson.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
75b1d5e68ffaebd2e3605679420b87ed268b43b0a938986d2c5f431048a19c28

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:42 GMT
Server
cloudflare
ETag
"7fd-554c1b98cff80"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cb18f7bedd-FRA
Content-Length
2045
nancy-edwards-jenkins.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/nancy-edwards-jenkins.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
658e96db3ad5576427e36fc75bdbce763f45e99f674e199e228e04f2eb2e0d88

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:52:12 GMT
Server
cloudflare
ETag
"776-554c1bb56c300"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cb1f9896e6-FRA
Content-Length
1910
natascha-durham-bivens.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/natascha-durham-bivens.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
398739e446f9d180bfbc79451ce96d988c909445a8d706a038c104d253774862

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:52:18 GMT
Server
cloudflare
ETag
"87b-554c1bbb25080"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cc3b36bebf-FRA
Content-Length
2171
lynda-dearing.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/lynda-dearing.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
20f2302b5427d2ac9b419d847576ef955d7c031a980daaf1b913d376a87e1dbe

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:52:04 GMT
Server
cloudflare
ETag
"826-554c1badcb100"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cc5f8026ee-FRA
Content-Length
2086
brian-laffitte.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/brian-laffitte.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
162c7d794875c3b28b78df0181d349583e8547b94b80db23cb8429f7b7dcb467

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:22 GMT
Server
cloudflare
ETag
"807-554c1b85bd280"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cc6a3e1f39-FRA
Content-Length
2055
erin-victoria-zimmerman.jpg
bismilbooks.com/bls/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/bls/erin-victoria-zimmerman.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ced13cabe7a73cf835951d0a28d6c48f0f17d8f8cddaefd78bfae2f4457de93

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:30 GMT
CF-Cache-Status
REVALIDATED
Last-Modified
Thu, 20 Jul 2017 15:51:28 GMT
Server
cloudflare
ETag
"7ac-554c1b8b76000"
Vary
Accept-Encoding
Content-Type
image/jpeg
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
569809cc7b45dfa5-FRA
Content-Length
1964
1841132608_500.jpg
bismilbooks.com/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/1841132608_500.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59f9df4ea7eaa907f1242ffcf64056795fa321e3b63a83b7ab3083f08edbe518

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:30 GMT
CF-Cache-Status
EXPIRED
Server
cloudflare
Vary
Accept-Encoding
Content-Type
image/jpg
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809cc8a51bedd-FRA
1847666736_500.jpg
bismilbooks.com/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/1847666736_500.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
732617002d54bbaa9e09481938754902594ae882b850089f02b7fa6f28561489

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:31 GMT
CF-Cache-Status
EXPIRED
Server
cloudflare
Vary
Accept-Encoding
Content-Type
image/jpg
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809cc88bd96e6-FRA
1887750045_500.jpg
bismilbooks.com/ 		167 KB
167 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/1887750045_500.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c83eebc4b429da3f58b6157166a0f42b2bcf928e1587f06a32ec4a54ffb1e3ff

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:31 GMT
CF-Cache-Status
EXPIRED
Server
cloudflare
Vary
Accept-Encoding
Content-Type
image/jpg
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809cd9c81bebf-FRA
194432853X_500.jpg
bismilbooks.com/ 		41 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://bismilbooks.com/194432853X_500.jpg
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
2606:4700:3033::681b:b508 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03306b781fe910acb9d9371672c6a02e097513e0fdeaa384d67b91e538bf6ab1

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:31 GMT
CF-Cache-Status
EXPIRED
Server
cloudflare
Vary
Accept-Encoding
Content-Type
image/jpg
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809d0594826ee-FRA
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.0.0/ 		81 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.0.0/jquery.min.js
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d482871a5e948cb4884fa0972ea98a81abca057b6bd3f8c995a18c12487e761c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 31 Jan 2020 00:54:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2016661
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
29195
x-xss-protection
0
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 30 Jan 2021 00:54:27 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.2/js/ 		35 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.2/js/bootstrap.min.js
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
c8eeec83fe8bf655eeeda291466d268770436dde4e3e40416a85d05d3893e892

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 23 Feb 2020 09:05:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:33:51 GMT
access-control-allow-origin
*
etag
"1544639631"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
9407
libcode3.js
adserver.adreactor.com/js/ 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://adserver.adreactor.com/js/libcode3.js
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
46.166.179.121 , Netherlands, ASN43350 (NFORCE, NL),
Reverse DNS
ptr9.adreactor.com
Software
nginx /
Resource Hash
c625a2066a674604ba2aac23404fa46feff44eabaec7ca90e7ca56c21806f2d3

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Jun 2019 05:24:34 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/javascript;charset=UTF-8
Cache-Control
public, max-age=86400
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Mon, 24 Feb 2020 09:05:28 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700%7CPT+Sans+Narrow%7CSource+Sans+Pro:200,300,400,600,700,900&subset=all
Origin
http://bismilbooks.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 04 Feb 2020 20:18:40 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:31:11 GMT
server
sffe
age
1601208
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9080
x-xss-protection
0
expires
Wed, 03 Feb 2021 20:18:40 GMT
6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v13/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700%7CPT+Sans+Narrow%7CSource+Sans+Pro:200,300,400,600,700,900&subset=all
Origin
http://bismilbooks.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 04 Feb 2020 05:28:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 03:46:05 GMT
server
sffe
age
1654593
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
13224
x-xss-protection
0
expires
Wed, 03 Feb 2021 05:28:55 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700%7CPT+Sans+Narrow%7CSource+Sans+Pro:200,300,400,600,700,900&subset=all
Origin
http://bismilbooks.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sat, 01 Feb 2020 00:22:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 23 Jul 2019 19:30:49 GMT
server
sffe
age
1932181
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9132
x-xss-protection
0
expires
Sun, 31 Jan 2021 00:22:27 GMT
glyphicons-halflings-regular.woff2
maxcdn.bootstrapcdn.com/bootstrap/3.3.2/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.2/fonts/glyphicons-halflings-regular.woff2
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

Referer
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.2/css/bootstrap.min.css
Origin
http://bismilbooks.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 23 Feb 2020 09:05:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:36:18 GMT
access-control-allow-origin
*
etag
"1544639778"
vary
Accept-Encoding
x-cache
HIT
content-type
font/woff2
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
18056
fontawesome-webfont.woff
maxcdn.bootstrapcdn.com/font-awesome/4.2.0/fonts/ 		64 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Referer
https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css
Origin
http://bismilbooks.com
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 23 Feb 2020 09:05:28 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:35:44 GMT
access-control-allow-origin
*
etag
"1544639744"
vary
Accept-Encoding
x-cache
HIT
content-type
font/woff
status
200
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
65464
sprite.png
readlibs.com/bls/
Redirect Chain
  • http://readlibs.com/bls/sprite.png
  • https://readlibs.com/bls/sprite.png
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://readlibs.com/bls/sprite.png
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681c:78b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://bismilbooks.com/css/coment.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

Date
Sun, 23 Feb 2020 09:05:28 GMT
Server
cloudflare
Vary
Accept-Encoding
Location
https://readlibs.com/bls/sprite.png
Cache-Control
max-age=3600
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
569809cb580ec2b3-FRA
Expires
Sun, 23 Feb 2020 10:05:28 GMT
js15_as.js
s10.histats.com/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://s10.histats.com/js15_as.js
Requested by
Host: bismilbooks.com
URL: http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
Protocol
HTTP/1.1
Server
46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 08:59:28 GMT
Content-Encoding
gzip
Last-Modified
Thu, 06 Dec 2018 14:12:12 GMT
X-CDN-Pop-IP
51.254.41.128/26
ETag
"-139234964"
X-Cacheable
Matched cache
Vary
Accept-Encoding
X-IPLB-Instance
32088
Content-Type
text/javascript
X-CDN-Pop
rbx1
Accept-Ranges
bytes
Content-Length
4525
X-Request-ID
162464459
0.php
s4.histats.com/stats/ 		50 B
321 B 		Script
General
Check archive.org
Download Go to
Full URL
http://s4.histats.com/stats/0.php?4217053&@f16&@g1&@h1&@i1&@j1582448728906&@k0&@l1&@mBlue%20Team%20Handbook%20SOC%20SIEM%20And%20Threat%20Hunting%20Use%20Cases%20A%20Condensed%20Field%20Guide%20For%20The%20Security%20Operations%20Team%20Volume%202%20-%20bismilbooks.com&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:85744337&@b3:1582448729&@b4:js15_as.js&@b5:60&@a-_0.2.1&@vhttp%3A%2F%2Fbismilbooks.com%2F1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf&@w
Requested by
Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Server
158.69.251.190 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns546644.ip-158-69-251.net
Software
/
Resource Hash
f3776a4a306339c080a1bf13c215fc94d1c06f6a4416f41e4216cbf384fae682

Request headers

Referer
http://bismilbooks.com/1726273989-Blue-Team-Handbook-SOC-SIEM-and-Threat-Hunting-Use-Cases-A-condensed-field-guide-for-the-Security-Operations-team-Volume-2.pdf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 23 Feb 2020 09:05:29 GMT
Connection
close
Content-Length
50
Content-Type
text/html;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _avp object| shortcut object| _Hasync function| $ function| jQuery object| AVP function| AVP_ActivateFlash function| AVP_ActivateFlashByVersion function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adserver.adreactor.com
ajax.googleapis.com
bismilbooks.com
fonts.googleapis.com
fonts.gstatic.com
lamborge.changeip.com
maxcdn.bootstrapcdn.com
readlibs.com
s10.histats.com
s4.histats.com
107.152.35.251
158.69.251.190
2001:4de0:ac19::1:b:2b
2606:4700:3033::681b:b508
2606:4700:3035::681c:78b
2a00:1450:4001:808::2003
2a00:1450:4001:80b::200a
2a00:1450:4001:825::200a
46.105.201.240
46.166.179.121
03306b781fe910acb9d9371672c6a02e097513e0fdeaa384d67b91e538bf6ab1
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
162c7d794875c3b28b78df0181d349583e8547b94b80db23cb8429f7b7dcb467
17d3160251567bf6b7233b0bc7932e5190c581c2aac8530370496e8e9df922fe
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1ced13cabe7a73cf835951d0a28d6c48f0f17d8f8cddaefd78bfae2f4457de93
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668
20f2302b5427d2ac9b419d847576ef955d7c031a980daaf1b913d376a87e1dbe
239781a075b6999a96ff28635c887a325d2153b9d4ebbd4f66c13a17673dedbc
308c941f3d8a0adf7e96a573dab73218e6a98d121a9ce85c7316402deefda362
398739e446f9d180bfbc79451ce96d988c909445a8d706a038c104d253774862
45f9afb06cf04e34138ce99e3fed860d538486e8eb6b3c63971eb553cc6b9436
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
58b0aa6d6b75d542b4950b5c4647add54b61d8f69fab4fab3ab41a3f4d916e4d
597e53b79ff4deb1fc7df091b2d9f00e174312bb061aca8dd5ec188a38ea2c47
59f9df4ea7eaa907f1242ffcf64056795fa321e3b63a83b7ab3083f08edbe518
658e96db3ad5576427e36fc75bdbce763f45e99f674e199e228e04f2eb2e0d88
681024f4a15d2c67834384cf97a7302855bb39c1136366ecd975dbf9d2992d19
732617002d54bbaa9e09481938754902594ae882b850089f02b7fa6f28561489
75b1d5e68ffaebd2e3605679420b87ed268b43b0a938986d2c5f431048a19c28
7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
b48dc4df31a155b47f0e155d90b022f2a7090aec7367eb25242818b643905b10
c625a2066a674604ba2aac23404fa46feff44eabaec7ca90e7ca56c21806f2d3
c83eebc4b429da3f58b6157166a0f42b2bcf928e1587f06a32ec4a54ffb1e3ff
c8eeec83fe8bf655eeeda291466d268770436dde4e3e40416a85d05d3893e892
d31bef450ee67b64f9b70bfdf41fe4e00c65438705cc1fbb48ea6026d3a5d697
d482871a5e948cb4884fa0972ea98a81abca057b6bd3f8c995a18c12487e761c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3776a4a306339c080a1bf13c215fc94d1c06f6a4416f41e4216cbf384fae682
f64e02e8aa2664534b53be9498b14529fbc4223ec67397137d4280ae59fd46bf
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c