urlscan.io logo urlscan.io
SecurityTrails logo

cyber.wtf Open in urlscan Pro
192.0.78.24  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Effective URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Submission: On December 08 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 4 domains to perform 46 HTTP transactions. The main IP is 192.0.78.24, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is cyber.wtf.
TLS certificate: Issued by R3 on December 5th 2023. Valid for: 3 months.
This is the only time cyber.wtf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.0.78.25 2635 (AUTOMATTIC)
2 192.0.78.24 2635 (AUTOMATTIC)
24 192.0.77.32 2635 (AUTOMATTIC)
11 192.0.72.22 2635 (AUTOMATTIC)
2 2a04:fa87:fff... 2635 (AUTOMATTIC)
4 192.0.76.3 2635 (AUTOMATTIC)
1 192.0.78.18 2635 (AUTOMATTIC)
1 192.0.78.23 2635 (AUTOMATTIC)
46 8
1    192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
cyber.wtf
2    192.0.78.24 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
cyber.wtf
24    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
widgets.wp.com
11    192.0.72.22 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
cyberwtf.files.wordpress.com
2    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
0.gravatar.com
4    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
1    192.0.78.18 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
r-login.wordpress.com
1    192.0.78.23 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
public-api.wordpress.com
Apex Domain
Subdomains		 Transfer
28 wp.com
s0.wp.com — Cisco Umbrella Rank: 7928
stats.wp.com — Cisco Umbrella Rank: 2814
widgets.wp.com — Cisco Umbrella Rank: 11563
pixel.wp.com — Cisco Umbrella Rank: 2796
239 KB
13 wordpress.com
cyberwtf.files.wordpress.com
r-login.wordpress.com — Cisco Umbrella Rank: 27432
public-api.wordpress.com — Cisco Umbrella Rank: 9281
815 KB
3 cyber.wtf
cyber.wtf
29 KB
2 gravatar.com
0.gravatar.com — Cisco Umbrella Rank: 8413
6 KB
46 4
Domain Requested by
23 s0.wp.com cyber.wtf
s0.wp.com
widgets.wp.com
public-api.wordpress.com
11 cyberwtf.files.wordpress.com cyber.wtf
3 pixel.wp.com cyber.wtf
3 cyber.wtf 1 redirects s0.wp.com
2 0.gravatar.com cyber.wtf
0.gravatar.com
1 public-api.wordpress.com s0.wp.com
1 r-login.wordpress.com cyber.wtf
1 widgets.wp.com cyber.wtf
1 stats.wp.com cyber.wtf
46 9
Subject Issuer Validity Valid
tls.automattic.com
R3		 2023-12-05 -
2024-03-04		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2023-11-28 -
2024-12-28		 a year crt.sh
*.files.wordpress.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
*.gravatar.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh
*.wordpress.com
Sectigo ECC Domain Validation Secure Server CA		 2023-12-05 -
2025-01-04		 a year crt.sh

This page contains 4 frames:

Primary Page: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Frame ID: BFDCC59859C8421C2382173B38B51CDF
Requests: 42 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=20231201
Frame ID: A9114028528B4663395857C7E6A14EE3
Requests: 3 HTTP requests in this frame

Frame: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9jeWJlci53dGY%3D&wpcomid=107487391&time=1702013551
Frame ID: 09E83BBC2323F29A2C64D70537352D8A
Requests: 1 HTTP requests in this frame

Frame: https://public-api.wordpress.com/wp-admin/rest-proxy/
Frame ID: 34A217524F9A6376D0D85D9B6BF7D610
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

The csharp-streamer RAT – cyber.wtf

Page URL History Show full URLs

  1. http://cyber.wtf/2023/12/06/the-csharp-streamer-rat/ HTTP 301
    https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+s\d+\.wp\.com
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

46
Requests

98 %
HTTPS

13 %
IPv6

4
Domains

9
Subdomains

8
IPs

2
Countries

1109 kB
Transfer

1801 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cyber.wtf/2023/12/06/the-csharp-streamer-rat/ HTTP 301
    https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

46 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Redirect Chain
  • http://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
  • https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
105 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
38bfcfa14951ad5f1c783ae8d0702ff5f2d3d83ca0a15200069b53ab65ea4ccc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 08 Dec 2023 05:36:34 GMT
host-header
WordPress.com
link
<https://wp.me/p7h0nB-ws>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding accept, content-type, cookie
x-ac
2.hhn _dfw HIT
x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.

Redirect headers

Connection
keep-alive
Content-Length
162
Content-Type
text/html
Date
Fri, 08 Dec 2023 05:36:34 GMT
Location
https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Server
nginx
X-ac
2.hhn _dfw BYPASS
/
s0.wp.com/_static/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/mu-plugins/jetpack-plugin/sun/modules/theme-tools/compat/twentysixteen.css,/wp-content/mu-plugins/likes/jetpack-likes.css?m=1701694548j&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
76bb2cbc897595770ceb85106baeedd49c3462459d5efce331ee1517bc8942b1

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Mon, 04 Dec 2023 12:56:07 GMT
server
nginx
etag
W/"656dcc67-46f7"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 03 Dec 2024 12:57:02 GMT
/
s0.wp.com/_static/ 		111 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJylzEEKgCAQQNELldNA5Co6S9pg1mShY+Htk67Q8vPhwXO19gxCQeDi7HxI4HJNQ9HVEwlu1ApVDyZ7XsDwafeWvYlzLJCkMCmbUgP/IFnp+KDpGFF32A+oEbcXJbE4TQ==&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
e3fb0a74126f8203a883b44827f044f24e90dca4dfdb9ed71f1c6c47327e4379

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 01 Dec 2023 20:15:29 GMT
server
nginx
etag
W/"656a3ee1-1bc9c"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 30 Nov 2024 20:23:54 GMT
/
s0.wp.com/_static/ 		159 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyVjV0OwiAQBi8kEKrR+mA8C4UN2br8hAVNby8mprEvGh8n+82semSB0VJzwGpmFcChAYIAsW4gk1mgCAJv7CIDRmmZd+qb3m+fvJFsivW1ydQ8Rla+dZygeDFRsrceg5qNvYn+NrUqfEGnuC4E/yeKqRg9/9BtemuD1KPUgjFkAlHgLg/KIdd1IdbQNVz0cdTjfhjOp/kJMmh7kg==&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
71df132c94f689f31822d47f4c4651b3639b7eb548a20bac80d9f30f686312a3

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 19 May 2023 01:53:28 GMT
server
nginx
etag
W/"6466d698-27db3"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 01 Oct 2024 14:57:58 GMT
/
s0.wp.com/_static/ 		369 B
675 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/mu-plugins/core-compat/wp-mediaelement.css,/wp-content/mu-plugins/wpcom-bbpress-premium-themes.css?m=1432920480j&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 19 May 2023 02:57:01 GMT
server
nginx
etag
"6466e57d-171"
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
369
expires
Sat, 09 Nov 2024 15:12:34 GMT
/
s0.wp.com/_static/ 		88 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d3583732d2d14bde8b2ce73f796d9295c0862a4e651011f5bd43302171b20e1a

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 26 May 2023 14:46:54 GMT
server
nginx
etag
W/"6470c65e-15fb2"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sun, 26 May 2024 15:34:59 GMT
923206c1-9f60-4f7d-8d12-1f0f0f5ea05e
https://cyber.wtf/ 		1 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://cyber.wtf/923206c1-9f60-4f7d-8d12-1f0f0f5ea05e
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Length
1245
Content-Type
text/javascript
/
s0.wp.com/_static/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJx9j0EOwjAMBD9EcHtoxQXxljQ1IcWJo9pR6O8JCAl64eZZaUYy1GwcJ8WkoDeMKJDLBFrbsEl4KGICJwKiG6Gp2XE8Nj7AjxiLyVR8SAILarbu/mGQkiDyXKh1a5g9aiuxC5ZMaPYe/nU9siF2VgOnHZgr2bD+U1eciH07/fuRL76kSzz342no+6Ebu+UJx6VlVA==&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
bad2ddd0fcb3fe31f9375e9ec5d7c5c5e83858c228a3485526affe0e65a133e3

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 26 May 2023 15:31:17 GMT
server
nginx
etag
W/"6470d0c5-580d"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 25 May 2024 16:44:32 GMT
/
s0.wp.com/_static/ 		29 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJyNjcsKAjEMRX/IGgbGyizET5HYhrZjmhTTIv69D9yIG3f3wOUcuDUXVDpJhzpc45GKGKzUG4bLh8GGQNU4mAws45Uixnh/zyJpG8w28LfoVCSAaSjIjjWpfcGPrGeqz2yeIbGekV+HYz1Mftn73bxMfn0AuUhIbg==&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d10ef16fd96e4cb694c0dc2718ce369c36d63a81b2bb6a71ed2584c90121e8f4

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Wed, 18 Oct 2023 18:48:48 GMT
server
nginx
etag
W/"65302890-7585"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Thu, 17 Oct 2024 19:16:49 GMT
/
s0.wp.com/_static/ 		39 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJxdjdsKwjAQRH/IuCpY7IP4KdI0a7sxN7KbXv7eCCrYxzlzhoE5qT4GwSBgGXzU5FAVxtwNlSkKj7i3vIN/LztRKcdl3XYyokeGVDTIXMHKtAhieI9G8e68HfiikisDBQaLkrr++cnAJXzRfcJgYoauSPSdCPU/eSKDMWVkBl3IGXBUr+MTg9KZzID18Oavx6Zt20tzag72BeE0Wsw=
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
2f59509c47c5c84513f49b962211db7fcc63ea06776447dc6b7ae401cc9ca5d1

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Tue, 14 Nov 2023 18:24:33 GMT
server
nginx
etag
W/"6553bb61-9b55"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Wed, 13 Nov 2024 18:35:59 GMT
/
s0.wp.com/ 		61 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/?custom-css=1&csblog=7h0nB&cscache=6&csrev=10
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
d9c009d49b0a5a1205d009b3f5a9d66628741791b7f68eb5bf9ae5bffd33b808

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
server
nginx
x-nc
HIT hhn 1
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
host-header
WordPress.com
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 09 Nov 2024 23:26:47 GMT
cyber-chrome2.png
cyberwtf.files.wordpress.com/2017/08/ 		275 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2017/08/cyber-chrome2.png
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cb0bf213e2c56228b4dba352ebefaa77a86c0d04cc7682fb00ef41c48359b8b6
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Wed, 09 Aug 2017 09:55:09 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
281226
expires
Sun, 31 Dec 2023 18:49:11 GMT
ps_obfuscated.png
cyberwtf.files.wordpress.com/2023/12/ 		217 KB
218 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_obfuscated.png?w=768
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
88a26a9fe26177ff2866e5965fe726af30ec23123f8721e93f9b6a108778c49a
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:40:33 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
222666
expires
Mon, 01 Jan 2024 08:41:07 GMT
ps_clean.png
cyberwtf.files.wordpress.com/2023/12/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_clean.png
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
3381c56cd15baca2ed0839980d80cc839a1ce66afe0f17dba18c519c0c1c61a1
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:43:26 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
41712
expires
Thu, 28 Dec 2023 15:20:26 GMT
ps_final.png
cyberwtf.files.wordpress.com/2023/12/ 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_final.png
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
081b7f63c93d0f0d9b58239b62f3915386112be503709d5f807135a195b33863
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:44:01 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
79288
expires
Sat, 06 Jan 2024 05:28:33 GMT
hovercards.min.js
0.gravatar.com/js/hovercards/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202349131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Fri, 08 Dec 2023 05:36:34 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
last-modified
Tue, 28 Nov 2023 13:47:28 GMT
server
nginx
etag
W/"6565ef70-329d"
content-type
application/javascript
cache-control
max-age=604800
alt-svc
h3=":443"; ma=86400
expires
Fri, 15 Dec 2023 05:36:34 GMT
wpgroho.js
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ 		655 B
702 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
hit
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/1125-1684465005221.1526
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 20:22:44 GMT
wpcom-gray-white.png
s0.wp.com/i/logo/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/i/logo/wpcom-gray-white.png
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
x-ac
2.hhn _dca MISS
last-modified
Fri, 19 May 2023 01:51:42 GMT
server
nginx
etag
"6466d62e-200b"
access-control-allow-methods
GET, HEAD
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
8203
expires
Sat, 09 Nov 2024 15:12:16 GMT
/
s0.wp.com/_static/ 		33 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJydjkEKwzAMBD9UV/EhoZfSt7i2CE5k2UQSpr9voMk1hx53dxgWenOxsiIrFHONbM4ssKC2ENcjgxhDqckIBWLYqgkSSM8NN/c2ToT3KHKD/2UncxZXvp7TjCqAtq91zegodFAsjYLuUtHP79CrPP30GL0fh2lYvo+gWEs=&cssminify=yes
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4896193dcadff37dc3a84b87d4eacc6911b816db2e4ebf05b12c3c19a6c5796f

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 26 May 2023 15:31:16 GMT
server
nginx
etag
W/"6470d0c4-8400"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Sat, 25 May 2024 16:37:47 GMT
/
s0.wp.com/_static/ 		87 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJydUe1SxCAMfCFprF+nPxwfxaGQa1MgYAP27u1FW/Wm3jij/8hmd5MlMCdlImfkDKGo5EtPLODJocBLwYKDZutxaka5gPNkE0OokFpE4wbYCr9VnY/GCVw17X3TKqGQPKoJX5sbsCR5cVpIykdt6xKBeOuXBwx1bCod5LkCR6FDRuR3uThKdQt2ah9NEbWnw1/k+8ImU+QfGU7Cj5iTNm6tQQrDM7GBrpC3YPQUi6D/on0C55KcuM5ke8wCWGo3OkLl9QwZ6xfpjBv8t9Os49Sc6lE25b9TyaAntNra48eTuF/jPIXHdnfZ7trr27uH8Q2WR+Iy
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
42d8d3c28b2e91f1c8d7a758925d5643471e15600f402b4dc832c0f32695cdd7

Request headers

Referer
https://cyber.wtf/
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca BYPASS
last-modified
Mon, 04 Dec 2023 18:12:57 GMT
server
nginx
etag
W/"656e16a9-15c3a"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Wed, 04 Dec 2024 20:57:27 GMT
w.js
stats.wp.com/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/w.js?65
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d38c258ea7516b3feaca9e160cbb16e1bba246298e4be0058c982e3b6de2b3c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
hit
x-nc
HIT hhn
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
server
nginx
x-minify
t
etag
W/11154-1701936236536.126
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Fri, 06 Dec 2024 09:16:02 GMT
png;base64,iVBORw0KGgoAAAANSUhEUgAAAAQAAAAECAYAAACp8Z5+AAAAG0lEQVQIW2NkYGD4z8DAwMgABXAGNgGwSgwVAFbmAgXxvZSoAAAAAElFTkSuQmCC
s0.wp.com/image/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAQAAAAECAYAAACp8Z5+AAAAG0lEQVQIW2NkYGD4z8DAwMgABXAGNgGwSgwVAFbmAgXxvZSoAAAAAElFTkSuQmCC
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/?custom-css=1&csblog=7h0nB&cscache=6&csrev=10
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.wp.com/?custom-css=1&csblog=7h0nB&cscache=6&csrev=10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers
montserrat-latin-700-normal.woff2
s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/montserrat/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/montserrat/montserrat-latin-700-normal.woff2?ver=25
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f31b80562610135edd91a86ec7f243c5eeaec2ec08337e6a20c2d135d8e217da

Request headers

Referer
https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
x-ac
2.hhn _dca MISS
last-modified
Fri, 05 May 2023 20:02:47 GMT
server
nginx
etag
"645560e7-3230"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
12848
expires
Sat, 04 May 2024 20:03:18 GMT
montserrat-latin-400-normal.woff2
s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/montserrat/ 		12 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/montserrat/montserrat-latin-400-normal.woff2?ver=25
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394

Request headers

Referer
https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
x-ac
2.hhn _dca MISS
last-modified
Fri, 05 May 2023 20:02:47 GMT
server
nginx
etag
"645560e7-31a4"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
12708
expires
Sat, 04 May 2024 20:03:18 GMT
inconsolata-latin-400-normal.woff2
s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/inconsolata/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/themes/pub/twentysixteen/fonts/inconsolata/inconsolata-latin-400-normal.woff2?ver=31
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4f9f98d74dc5dea24db279aedd49367424c72cba9fb67341cbef8bcd2f0ad002

Request headers

Referer
https://s0.wp.com/_static/??-eJyNkN0OwiAMhV9IbKbx78L4KIYtdTKgEOgyfXuLGLOoF971fPScngBTVF0gRmLwo4pu7A1l6IL3gpQzFkXlD7IUsgADFNiIO7+H+jDL5Ct6SYhjCzwJuGdzY0SCiyxk8JiSmVDLWirHs/KFC9VctaGSG5xm/RU+KzwgR93Zl4Y8EpzFCj0Sptrx51gzW6fJ/t+9/EfrQmef9pM/Ntv9pmlW68NueACbuH/k&cssminify=yes
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
x-ac
2.hhn _dca BYPASS
last-modified
Fri, 05 May 2023 20:02:46 GMT
server
nginx
etag
"645560e6-3f74"
access-control-allow-methods
GET, HEAD
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
16244
expires
Sat, 04 May 2024 20:09:08 GMT
truncated
/ 		7 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
157d1d1d4610165ac55888450861699732d6284cc50b9e5c3381b510650558cc

Request headers

Referer
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer
Origin
https://cyber.wtf
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
master.html
widgets.wp.com/likes/ Frame A911 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://widgets.wp.com/likes/master.html?ver=20231201
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
753a9865146ac5c3a2407fa2efc4acbbf0533f18dc4807801083cb30d8397b0a

Request headers

Referer
https://cyber.wtf/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-methods
GET, HEAD
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-encoding
br
content-type
text/html
date
Fri, 08 Dec 2023 05:36:34 GMT
etag
W/"656e16a1-b4a"
last-modified
Mon, 04 Dec 2023 18:12:49 GMT
server
nginx
timing-allow-origin
*
vary
Accept-Encoding
x-ac
2.hhn _dca MISS
x-nc
HIT hhn 1
g.gif
pixel.wp.com/ 		50 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?x_stats-initial-visibility=visible&v=wpcom-no-pv&rand=0.44228647638527896
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 08 Dec 2023 05:36:34 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?blog=107487391&v=wpcom&tz=1&user_id=0&post=2012&subd=cyberwtf&host=cyber.wtf&ref=&rand=0.8218899169367513
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 08 Dec 2023 05:36:34 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/ 		50 B
153 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?crypt=UE40eW5QN0p8M2Y%2FRE1mNzc2NTVTamdsRWFxcEV3XUtMXVR5aWlmMVNIcUxBaFstUWRrZVpWQ2tORExSfEpUVm05SlpEZzZWOEtlbW5nZHV0dkhDNjhwP35JbkdHLyZqSUh8WkZWfC94N0RyQTJvclV5STNkPXcvP3x4SjZBMXZiSlBYL0JyTVlySy1mR2FzXXFHTTVKXXR3R2RhdFcsSzNYbVhYd1glJWRLcHlXU3hGRT1fQVBJUT9oP1Q9dDRFcnlYTFpwXV1fUjRQX3h8U2NuQVFEUEZ5VmRSSFIwPTMvMURZbHl4cEtLd0htNUFQbD1QVGVGKzN0YzdOcj9YNT1vTEM%2FeS03bzhnLS8vNltVdCYtVUkzNElVeld0Uk5%2Bd1NVeER6V1JVWmEzUFpld01%2BcFAyX2xsJkU2UyZmVGVrVDBELm5zYW5JXz1MSzhdQVpHaW0wTnBqV0VSaGZkSWtiP3pnREV2eCxUJmpSTQ%3D%3D&v=wpcom-no-pv&rand=0.7784489859312789
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 08 Dec 2023 05:36:34 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
wp-emoji-release.min.js
s0.wp.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1677072837i&ver=6.5-alpha-57144
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
last-modified
Fri, 22 Sep 2023 22:35:28 GMT
server
nginx
etag
W/"650e16b0-4904"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Fri, 06 Dec 2024 15:35:59 GMT
hovercards.min.css
0.gravatar.com/js/hovercards/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/hovercards/hovercards.min.css?ver=202349131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Requested by
Host: 0.gravatar.com
URL: https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202349131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date
Fri, 08 Dec 2023 05:36:34 GMT
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
last-modified
Wed, 11 Oct 2023 03:50:13 GMT
server
nginx
etag
W/"65261b75-d5d"
content-type
text/css
cache-control
max-age=604800
alt-svc
h3=":443"; ma=86400
expires
Fri, 15 Dec 2023 05:36:34 GMT
ps_obfuscated.png
cyberwtf.files.wordpress.com/2023/12/ 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_obfuscated.png?w=831
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a8421f64d9449997eec5ec4223cc6ee1dae17116aea58a1895f3916a92aefeb2
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:40:33 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
54854
expires
Fri, 12 Jan 2024 05:11:17 GMT
ps_clean.png
cyberwtf.files.wordpress.com/2023/12/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_clean.png?w=624
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
3381c56cd15baca2ed0839980d80cc839a1ce66afe0f17dba18c519c0c1c61a1
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:43:26 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
41712
expires
Sat, 30 Dec 2023 22:36:51 GMT
ps_final.png
cyberwtf.files.wordpress.com/2023/12/ 		77 KB
78 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/ps_final.png?w=916
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
081b7f63c93d0f0d9b58239b62f3915386112be503709d5f807135a195b33863
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:44:01 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
79288
expires
Sat, 30 Dec 2023 14:18:42 GMT
startup.png
cyberwtf.files.wordpress.com/2023/12/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/startup.png?w=634
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
26e2d60b88d7275fbecafeb3f0421d960400692b14cb5f06b7351362a883e2c7
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:45:34 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
7736
expires
Sat, 06 Jan 2024 09:19:04 GMT
packetstruct.png
cyberwtf.files.wordpress.com/2023/12/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/packetstruct.png?w=606
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
677b2a75333b6c86d0227c6e58e3ba0d51a6b6bac2594f6229125210ecb2b978
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:46:39 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
9586
expires
Thu, 11 Jan 2024 17:28:05 GMT
packettypes-1.png
cyberwtf.files.wordpress.com/2023/12/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/packettypes-1.png?w=188
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4795a1770229c2b9a8fea21b909791d77168f4c7347ed10e37f910f14cb746e0
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:48:08 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
2726
expires
Sun, 14 Jan 2024 16:42:53 GMT
cmdhelp.png
cyberwtf.files.wordpress.com/2023/12/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cyberwtf.files.wordpress.com/2023/12/cmdhelp.png?w=974
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
20e4c0a6db7ff3f1f4b32eda5e4fbaa692905213760a234b41abc3433c0ca779
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 22 np
date
Fri, 08 Dec 2023 05:36:34 GMT
x-content-type-options
nosniff, nosniff
last-modified
Tue, 05 Dec 2023 16:51:21 GMT
server
nginx
x-orig-src
0_imageresize
vary
Accept, Origin
content-type
image/webp
access-control-allow-origin
https://cyberwtf.wordpress.com
access-control-allow-credentials
true
accept-ranges
bytes
content-length
4640
expires
Sat, 30 Dec 2023 23:20:16 GMT
remote-login.php
r-login.wordpress.com/ Frame 09E8 		131 B
352 B 		Document
General
Check archive.org
Download Go to
Full URL
https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9jeWJlci53dGY%3D&wpcomid=107487391&time=1702013551
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.18 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
65efa68b1e79a432faee3104453ce35314a6ef45aa8cdb52fd2dcea52c5d18fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://cyber.wtf/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, must-revalidate, max-age=0
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 08 Dec 2023 05:36:35 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Cookie
x-ac
1.hhn _dfw MISS
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame A911 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by
Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20231201
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://widgets.wp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
hit
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/7325-1684461116096.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 14:44:30 GMT
/
s0.wp.com/_static/ Frame A911 		85 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20231201
Requested by
Host: widgets.wp.com
URL: https://widgets.wp.com/likes/master.html?ver=20231201
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
65f5df9264f33ebdcbc28212a2625a16dc7d458984f267f6fcf908d970443b3c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://widgets.wp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Fri, 08 Dec 2023 05:36:34 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
last-modified
Mon, 04 Dec 2023 18:12:57 GMT
server
nginx
etag
W/"656e16a9-152bd"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
alt-svc
h3=":443"; ma=86400
expires
Tue, 03 Dec 2024 18:13:08 GMT
/
public-api.wordpress.com/wp-admin/rest-proxy/ Frame 34A2 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public-api.wordpress.com/wp-admin/rest-proxy/
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/_static/??/wp-content/js/postmessage.js,/wp-content/js/tannin/compat.min.js,/wp-content/js/wpcom-proxy-request.js,/wp-content/js/likes-rest-nojquery.js?m=20231201
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.23 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4b4f298a5eb39eae4292bcef72c8f484854cf331454bd142d39b08d44fada2f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://widgets.wp.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 08 Dec 2023 05:36:35 GMT
p3p
CP="CAO PSA OUR"
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-ac
1.hhn _dfw BYPASS
rlt-proxy.js
s0.wp.com/wp-content/js/ Frame 34A2 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/js/rlt-proxy.js?m=20211122
Requested by
Host: public-api.wordpress.com
URL: https://public-api.wordpress.com/wp-admin/rest-proxy/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://public-api.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
hit
date
Fri, 08 Dec 2023 05:36:35 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/7325-1684461116096.7104
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 30 May 2024 14:44:30 GMT
actionbar.css
s0.wp.com/wp-content/mu-plugins/actionbar/ 		15 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20231122
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
1ae482468bc3314fb40eef73ab1d7e71a03ae9d0b53658799b14baf4525bf82b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
miss
date
Fri, 08 Dec 2023 05:36:35 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/18162-1700658725859.6414
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 21 Nov 2024 13:12:13 GMT
actionbar.js
s0.wp.com/wp-content/mu-plugins/actionbar/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20231122
Requested by
Host: cyber.wtf
URL: https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
28bac34917bba2f5ebef5c3a1533fdfcd9c7c6e0accef5bc18addd58adeb1181

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cyber.wtf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-minify-cache
hit
date
Fri, 08 Dec 2023 05:36:35 GMT
content-encoding
br
x-ac
2.hhn _dca MISS
x-minify
t
alt-svc
h3=":443"; ma=86400
x-nc
HIT hhn 1
server
nginx
etag
W/15129-1699585415136.014
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
expires
Thu, 21 Nov 2024 12:53:02 GMT
admin-ajax.php
cyber.wtf/wp-admin/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cyber.wtf/wp-admin/admin-ajax.php
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20231122
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.24 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-hacker
Want root? Visit join.a8c.com/hacker and mention this header.
date
Fri, 08 Dec 2023 05:36:35 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
x-ac
2.hhn _dfw BYPASS
host-header
WordPress.com
referrer-policy
strict-origin-when-cross-origin
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://cyber.wtf
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
expires
Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

54 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| documentPictureInPicture string| wpcom_remote_login_extra_auth function| wpcom_remote_login_remove_dom_node_id function| wpcom_remote_login_remove_dom_node_classes function| wpcom_remote_login_final_cleanup function| addLoadEvent object| _wpemojiSettings object| videopressAjax object| actionbardata object| wpcom_mobile_user_agent_info function| rltInvalidateToken function| rltInjectToken function| rltIsAuthenticated function| rltGetToken function| rltAddInitializationListener function| rltStoreToken function| rltInitialize object| html5 object| Gravatar object| WPGroHo object| WPCOM_sharing_counts object| comment_like_text object| wpcom_coblocks_js object| coblocksLigthboxData object| screenReaderText object| jetpackSwiperLibraryPath object| jetpackCarouselStrings object| sharing_js_options object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady number| jetpackLikesLookAhead object| jetpackCommentLikesLoadedWidgets object| jetpackLikesDocReadyPromise function| JetpackLikesPostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| JetpackLikesWidgetQueueHandler function| jetpackLoadLikeWidgetIframe function| jetpackGetUnloadedWidgetsInView function| jetpackIsScrolledIntoView function| jetpackUnloadScrolledOutWidgets function| jetpackWidgetsDelayedExec function| jetpackOnScrollStopped object| wpcom object| WPCOMSharing undefined| windowOpen object| _tkq object| _stq string| mobileStatsQueryString boolean| comment_likes_loaded object| twemoji object| wp

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://s0.wp.com/image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAQAAAAECAYAAACp8Z5+AAAAG0lEQVQIW2NkYGD4z8DAwMgABXAGNgGwSgwVAFbmAgXxvZSoAAAAAElFTkSuQmCC
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=key&origin=aHR0cHM6Ly9jeWJlci53dGY%3D&wpcomid=107487391&time=1702013551(Line 2)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://r-login.wordpress.com') does not match the recipient window's origin ('https://cyber.wtf').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
cyber.wtf
cyberwtf.files.wordpress.com
pixel.wp.com
public-api.wordpress.com
r-login.wordpress.com
s0.wp.com
stats.wp.com
widgets.wp.com
192.0.72.22
192.0.76.3
192.0.77.32
192.0.78.18
192.0.78.23
192.0.78.24
192.0.78.25
2a04:fa87:fffe::c000:4902
081b7f63c93d0f0d9b58239b62f3915386112be503709d5f807135a195b33863
131f6b765e798866d728f95661b78bbf269c86482ffff0fa8c08e18a1a65cc89
157d1d1d4610165ac55888450861699732d6284cc50b9e5c3381b510650558cc
1ae482468bc3314fb40eef73ab1d7e71a03ae9d0b53658799b14baf4525bf82b
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
20e4c0a6db7ff3f1f4b32eda5e4fbaa692905213760a234b41abc3433c0ca779
26e2d60b88d7275fbecafeb3f0421d960400692b14cb5f06b7351362a883e2c7
28bac34917bba2f5ebef5c3a1533fdfcd9c7c6e0accef5bc18addd58adeb1181
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
2f59509c47c5c84513f49b962211db7fcc63ea06776447dc6b7ae401cc9ca5d1
3381c56cd15baca2ed0839980d80cc839a1ce66afe0f17dba18c519c0c1c61a1
38bfcfa14951ad5f1c783ae8d0702ff5f2d3d83ca0a15200069b53ab65ea4ccc
42d8d3c28b2e91f1c8d7a758925d5643471e15600f402b4dc832c0f32695cdd7
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
4795a1770229c2b9a8fea21b909791d77168f4c7347ed10e37f910f14cb746e0
4896193dcadff37dc3a84b87d4eacc6911b816db2e4ebf05b12c3c19a6c5796f
4b4f298a5eb39eae4292bcef72c8f484854cf331454bd142d39b08d44fada2f1
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4f9f98d74dc5dea24db279aedd49367424c72cba9fb67341cbef8bcd2f0ad002
65efa68b1e79a432faee3104453ce35314a6ef45aa8cdb52fd2dcea52c5d18fd
65f5df9264f33ebdcbc28212a2625a16dc7d458984f267f6fcf908d970443b3c
677b2a75333b6c86d0227c6e58e3ba0d51a6b6bac2594f6229125210ecb2b978
71df132c94f689f31822d47f4c4651b3639b7eb548a20bac80d9f30f686312a3
753a9865146ac5c3a2407fa2efc4acbbf0533f18dc4807801083cb30d8397b0a
76bb2cbc897595770ceb85106baeedd49c3462459d5efce331ee1517bc8942b1
88a26a9fe26177ff2866e5965fe726af30ec23123f8721e93f9b6a108778c49a
9c83b89ab9d2677980617afacb833a74da3050a2d3d711176b500d7922e49ab5
a8421f64d9449997eec5ec4223cc6ee1dae17116aea58a1895f3916a92aefeb2
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8
bad2ddd0fcb3fe31f9375e9ec5d7c5c5e83858c228a3485526affe0e65a133e3
c0e93b5ebf107af77d9e7d101d186b3b93e9d5ad4fbb6a74e2dea60173cc04f8
cb0bf213e2c56228b4dba352ebefaa77a86c0d04cc7682fb00ef41c48359b8b6
d10ef16fd96e4cb694c0dc2718ce369c36d63a81b2bb6a71ed2584c90121e8f4
d3583732d2d14bde8b2ce73f796d9295c0862a4e651011f5bd43302171b20e1a
d38c258ea7516b3feaca9e160cbb16e1bba246298e4be0058c982e3b6de2b3c1
d9c009d49b0a5a1205d009b3f5a9d66628741791b7f68eb5bf9ae5bffd33b808
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fb0a74126f8203a883b44827f044f24e90dca4dfdb9ed71f1c6c47327e4379
f31b80562610135edd91a86ec7f243c5eeaec2ec08337e6a20c2d135d8e217da
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f72ea1589b707feb0d369c239e89cc4ca754d70645c76e3a61ba0af9d69bba8c