URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Submission: On January 30 via manual from JP

Summary

This website contacted 28 IPs in 2 countries across 20 domains to perform 114 HTTP transactions. The main IP is 2606:4700:30::6812:2ddf, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is gbhackers.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 1st 2019. Valid for: 6 months.
This is the only time gbhackers.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 2606:4700:30:... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
38 192.0.77.2 2635 (AUTOMATTIC)
1 2a04:fa87:fff... 2635 (AUTOMATTIC)
1 192.0.77.32 2635 (AUTOMATTIC)
4 192.0.76.3 2635 (AUTOMATTIC)
12 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 172.217.18.98 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 34.198.243.3 14618 (AMAZON-AES)
4 151.101.120.134 54113 (FASTLY)
1 23.210.248.189 16625 (AKAMAI-AS)
1 2a03:2880:f01... 32934 (FACEBOOK)
2 143.204.101.59 16509 (AMAZON-02)
3 143.204.101.33 16509 (AMAZON-02)
1 13.35.198.65 16509 (AMAZON-02)
5 2606:4700::68... 13335 (CLOUDFLAR...)
2 151.101.192.134 54113 (FASTLY)
1 151.101.0.233 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
114 28
Domain Requested by
21 i1.wp.com gbhackers.com
12 fonts.gstatic.com gbhackers.com
pagead2.googlesyndication.com
10 gbhackers.com gbhackers.com
pagead2.googlesyndication.com
9 i0.wp.com gbhackers.com
8 i2.wp.com gbhackers.com
7 googleads.g.doubleclick.net pagead2.googlesyndication.com
6 pagead2.googlesyndication.com gbhackers.com
pagead2.googlesyndication.com
5 c.disquscdn.com https-gbhackers-com.disqus.com
3 img4.zergnet.com gbhackers.com
3 pixel.wp.com gbhackers.com
2 referrer.disqus.com gbhackers.com
2 disqus.com https-gbhackers-com.disqus.com
2 img2.zergnet.com gbhackers.com
2 https-gbhackers-com.disqus.com gbhackers.com
2 www.zergnet.com gbhackers.com
www.zergnet.com
2 www.google-analytics.com 1 redirects www.googletagmanager.com
2 www.googletagservices.com gbhackers.com
pagead2.googlesyndication.com
2 fonts.googleapis.com gbhackers.com
1 cdn.ampproject.org pagead2.googlesyndication.com
1 disqusads.com https-gbhackers-com.disqus.com
1 img1.zergnet.com gbhackers.com
1 graph.facebook.com gbhackers.com
1 api.pinterest.com gbhackers.com
1 stats.g.doubleclick.net gbhackers.com
1 securepubads.g.doubleclick.net www.googletagservices.com
1 onesignal.com cdn.onesignal.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 stats.wp.com gbhackers.com
1 s0.wp.com gbhackers.com
1 secure.gravatar.com gbhackers.com
1 www.googletagmanager.com gbhackers.com
1 cdn.onesignal.com gbhackers.com
114 33
Subject Issuer Validity Valid
sni185887.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-01-01 -
2019-07-10
6 months crt.sh
*.googleapis.com
Google Internet Authority G3
2018-12-19 -
2019-03-13
3 months crt.sh
ssl473492.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-01-22 -
2019-07-31
6 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2018-12-19 -
2019-03-13
3 months crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2018-12-19 -
2019-03-13
3 months crt.sh
*.wp.com
Go Daddy Secure Certificate Authority - G2
2018-04-10 -
2020-05-11
2 years crt.sh
*.gravatar.com
COMODO RSA Domain Validation Secure Server CA
2018-09-06 -
2020-09-05
2 years crt.sh
*.google.com
Google Internet Authority G3
2018-12-19 -
2019-03-13
3 months crt.sh
www.zergnet.com
Go Daddy Secure Certificate Authority - G2
2016-06-21 -
2019-07-13
3 years crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA
2018-03-28 -
2020-04-27
2 years crt.sh
*.pinterest.com
DigiCert SHA2 High Assurance Server CA
2019-01-10 -
2019-06-26
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2019-01-21 -
2019-04-21
3 months crt.sh
*.zergnet.com
Amazon
2018-06-22 -
2019-07-22
a year crt.sh
ssl565697.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-10-07 -
2019-04-15
6 months crt.sh
m.ssl.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2018-09-24 -
2019-09-01
a year crt.sh
misc-sni.google.com
Google Internet Authority G3
2018-12-19 -
2019-03-13
3 months crt.sh

This page contains 13 frames:

Primary Page: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Frame ID: BD729777560613DB1FDE01C8FAC0DB67
Requests: 103 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Frame ID: 309635EEA7EDCC3B2796FE64AA90E6EC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20190128/r20180604/zrt_lookup.html
Frame ID: 25CC130091A864079F60BC86FCA0731E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8834194653550774&output=html&h=600&slotname=3739790355&adk=2177241702&adf=601649486&w=160&lmt=1548807402&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807401920&bpp=26&bdt=303&fdt=335&idt=334&shv=r20190128&cbv=r20180604&saldr=sa&abxe=1&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=9379162794&dssz=37&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1425&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfeE%7C&abl=CF&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2542721524&ifi=1&uci=1.cwusjtdfwb23&fsb=1&xpc=ktOCi903el&p=https%3A//gbhackers.com&dtd=371
Frame ID: 24D121309D5DD55E8884810B366F464F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=7425084999&adk=4082770917&adf=193766564&w=728&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402068&bpp=19&bdt=452&fdt=384&idt=186&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=599&ady=56&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&ppjl=u&pfx=0&fu=16&bc=15&osw_key=970116236&ifi=2&uci=2.nexguga1tqtz&fsb=1&xpc=Pk0S8hOPTQ&p=https%3A//gbhackers.com&dtd=427
Frame ID: E12CCF518DAF3B602DBE183ABAD41AF6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=8042110665&adk=1636884126&adf=1188380921&w=696&fwrn=4&lmt=1548807402&rafmt=10&guci=1.2.0.0.2.2.0.0&format=696x90_0ads_al&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1548807402087&bpp=6&bdt=470&fdt=473&idt=167&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=621&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=846765324&ifi=3&uci=3.1zbsw3cz96la&fsb=1&xpc=jQOJRUS7Cb&p=https%3A//gbhackers.com&dtd=479
Frame ID: 3151020E0EF5BC3FB54456E02AFEC454
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=1238950596&adk=3942814845&adf=1822826330&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402093&bpp=4&bdt=477&fdt=495&idt=161&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=1316&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2837082468&ifi=4&uci=4.fo27eoyiezu3&fsb=1&xpc=p82iN14iAi&p=https%3A//gbhackers.com&dtd=499
Frame ID: 6C3DE5711D7A8936117BCA52F91CC4D0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=174&slotname=9047224592&adk=1901560027&adf=2977663563&w=696&fwrn=4&lmt=1548807402&rafmt=11&guci=1.2.0.0.2.2.0.0&format=696x174&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402097&bpp=6&bdt=480&fdt=541&idt=157&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&rplot=4&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=1920&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=2565238555&ifi=5&uci=5.1eep1gqq8xtw&fsb=1&xpc=18SOftqFAh&p=https%3A//gbhackers.com&dtd=545
Frame ID: FBEB89CEEC9C9C49DF968D8D1611B1DC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=2715683798&adk=1367495304&adf=3022620766&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402103&bpp=3&bdt=487&fdt=549&idt=151&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250%2C696x174&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=54&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=4377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=1490544511&ifi=6&uci=6.vpxxg6lefsak&fsb=1&xpc=2tuEQDdaQQ&p=https%3A//gbhackers.com&dtd=553
Frame ID: F33E926E555DF469145DE815FB02EEA4
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=https-gbhackers-com&t_i=26813%20https%3A%2F%2Fgbhackers.com%2F%3Fp%3D26813&t_u=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&t_e=Hackers%20Conducting%20RDP%20Attacks%20Using%20New%20Technique%20to%20Bypass%20Protections&t_d=Hackers%20Conducting%20New%20RDP%20Attack%20That%20Bypass%20Protection&t_t=Hackers%20Conducting%20RDP%20Attacks%20Using%20New%20Technique%20to%20Bypass%20Protections&s_o=default
Frame ID: A80C54DBB63C9D1E3E9F7B4559BDABA0
Requests: 1 HTTP requests in this frame

Frame: https://disqusads.com/ads-iframe/taboola/?category=tech&display_bidding_enabled=0&stories_allowed=0&service=dynamic&position=bottom&display_allowed=0&video_allowed=0&provider=taboola&thumbnails_allowed=1&experiment=network_default&variant=fallthrough&display_only=0&sandbox_display=1&links_allowed=1&doublewide_allowed=1&shortname=https-gbhackers-com&forum_pk=4725420&forum_shortname=https-gbhackers-com&safetylevel=30&t=1548807402&anchorColor=%2300a382&colorScheme=light&sourceUrl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&disqus_version=78d9b83
Frame ID: 229E180044297A626EAD451EF04EC3B8
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: D18873A810DE11CF3E8349A5D203712A
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: CDB86970BF72C50CA90CA599C572BE51
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-includes\//i
  • meta generator /WordPress( [\d.]+)?/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+s\d+\.wp\.com/i
  • script /\/wp-includes\//i
  • meta generator /WordPress( [\d.]+)?/i

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Overall confidence: 100%
Detected patterns
  • env /^DISQUS/i

Overall confidence: 100%
Detected patterns
  • script /googlesyndication\.com\//i
  • env /^google_ad_/i
  • env /^__google_ad_/i
  • env /^Goog_AdSense_/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • env /^googletag$/i
  • env /^google_tag_manager$/i

Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

114
Requests

100 %
HTTPS

56 %
IPv6

20
Domains

33
Subdomains

28
IPs

2
Countries

1578 kB
Transfer

4742 kB
Size

12
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 75
  • https://www.google-analytics.com/r/collect?v=1&_v=j73&a=808268513&t=pageview&_s=1&dl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&ul=en-us&de=UTF-8&dt=Hackers%20Conducting%20New%20RDP%20Attack%20That%20Bypass%20Protection&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=1951600793&gjid=3289225&cid=1111923185.1548807402&tid=UA-88811382-1&_gid=44108446.1548807402&_r=1&gtm=2ou1d1&z=828222605 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-88811382-1&cid=1111923185.1548807402&jid=1951600793&_gid=44108446.1548807402&gjid=3289225&_v=j73&z=828222605

114 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
gbhackers.com/threat-actors-conducting-rdp-attacks/
135 KB
23 KB
Document
General
Full URL
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
65b7d240d14e3bc948b60dd11e6c582468b9cf2e0ac3e1146a4da5231283a8f4
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
gbhackers.com
:scheme
https
:path
/threat-actors-conducting-rdp-attacks/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 30 Jan 2019 00:16:41 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397; expires=Thu, 30-Jan-20 00:16:37 GMT; path=/; domain=.gbhackers.com; HttpOnly
x-pingback
https://gbhackers.com/xmlrpc.php
cache-control
max-age=2592000
expires
Fri, 01 Mar 2019 00:16:37 GMT
vary
Accept-Encoding,User-Agent
x-xss-protection
1; mode=block
x-varnish
69369
age
0
x-cache
MISS
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4a0fc0395f6363eb-FRA
content-encoding
br
autoptimize_824732f707129ba9237a0714f1cc991d.css
gbhackers.com/wp-content/cache/autoptimize/css/
1 MB
163 KB
Stylesheet
General
Full URL
https://gbhackers.com/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c88bebaf4de9d9276e9b8ad07c7e99a9eecef136fc492d87e20cbb05f11d9c0
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
br
cf-cache-status
HIT
cf-polished
origSize=1478488
cf-ray
4a0fc0542cab63eb-FRA
x-cache
HIT
status
200
last-modified
Sat, 12 Jan 2019 03:06:06 GMT
x-cache-hits
1
x-xss-protection
1; mode=block
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-varnish
1901172 1475882
cache-control
public, max-age=30672000
content-type
text/css
expires
Mon, 20 Jan 2020 00:16:41 GMT
css
fonts.googleapis.com/
5 KB
758 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
17bd4bcb69e324586fcc2400c75915b7dfdc25a4ecb96fedd885dbb2fbcbf793
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 30 Jan 2019 00:16:41 GMT
server
ESF
access-control-allow-origin
*
date
Wed, 30 Jan 2019 00:16:41 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:41 GMT
css
fonts.googleapis.com/
31 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
41c18139cfaa7d2fc18229a5437b93a878614df5d69e205f18466c8ac571b7c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 30 Jan 2019 00:16:41 GMT
server
ESF
access-control-allow-origin
*
date
Wed, 30 Jan 2019 00:16:41 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:41 GMT
jquery.js
gbhackers.com/wp-includes/js/jquery/
95 KB
32 KB
Script
General
Full URL
https://gbhackers.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a4c252da9c4b03a65ca99a734ef82408df893c1b6a5d5a49c4f87f774bc4f75
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-includes/js/jquery/jquery.js?ver=1.12.4
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
br
cf-cache-status
HIT
cf-polished
origSize=97184
cf-ray
4a0fc0542cac63eb-FRA
x-cache
MISS
status
200
cf-bgj
minify
x-xss-protection
1; mode=block
last-modified
Tue, 24 May 2016 00:00:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-varnish
1869030
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Thu, 30 Jan 2020 00:16:41 GMT
OneSignalSDK.js
cdn.onesignal.com/sdks/
357 KB
71 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cda5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d375885e4c44867357619a926d41d98072e018b67ced595e18e38a0bb5aeeee4

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 29 Jan 2019 22:54:02 GMT
server
cloudflare
etag
W/"5c50d98a-59458"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=259200
cf-ray
4a0fc0545daebf07-FRA
expires
Sat, 02 Feb 2019 00:16:41 GMT
js
www.googletagmanager.com/gtag/
91 KB
33 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-88811382-1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:815::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
a6397fd6239e7596e8cad9932cbdd8a8fd47be6d4a831a29a2ea941c7164a3ae
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
server
Google Tag Manager (scaffolding)
access-control-allow-origin
http://www.googletagmanager.com
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
status
200
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
content-length
33249
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:41 GMT
gpt.js
www.googletagservices.com/tag/js/
29 KB
10 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81c::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
f2e95b3bfee0ab6c773ba2ff7b64657abfe7f5e942438049cc981f4d37fd029a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"67 / 163 of 1000 / last-modified: 1548791455"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
10013
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:41 GMT
gbhackers.png
gbhackers.com/wp-content/uploads/2017/11/
3 KB
3 KB
Image
General
Full URL
https://gbhackers.com/wp-content/uploads/2017/11/gbhackers.png
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b15acdd4ca105bbe67c32598b72e1ad2b8e18e2840e3976be9d9f9c93753512
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/2017/11/gbhackers.png
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
cf-cache-status
HIT
cf-ray
4a0fc054fd1263eb-FRA
x-cache
MISS
status
200
content-length
3318
x-xss-protection
1; mode=block
last-modified
Thu, 30 Nov 2017 06:02:36 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
x-varnish
1508933
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/png
expires
Fri, 01 Mar 2019 00:16:41 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/
79 KB
29 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0be8ba1b272f2e7df3f85e111841fef12cd2e281dc2eda3d1a048e865f728a28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
29887
x-xss-protection
1; mode=block
server
cafe
etag
463637289324252710
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 30 Jan 2019 00:16:41 GMT
Banner.jpg
gbhackers.com/wp-content/uploads/2018/11/
60 KB
60 KB
Image
General
Full URL
https://gbhackers.com/wp-content/uploads/2018/11/Banner.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4899e928e4bfc49a9d7c217d43673490597ea41fe1f2d9a67b424b42bbdbdbd1
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/uploads/2018/11/Banner.jpg
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
cf-cache-status
HIT
cf-ray
4a0fc054fd1363eb-FRA
x-cache
MISS
status
200
content-length
61087
x-xss-protection
1; mode=block
last-modified
Fri, 16 Nov 2018 10:50:42 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent, Accept-Encoding
x-varnish
1508937
cache-control
public, max-age=2592000
accept-ranges
bytes
content-type
image/jpeg
expires
Fri, 01 Mar 2019 00:16:41 GMT
RDP-attack.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
36 KB
37 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/RDP-attack.jpg?resize=696%2C363&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
34e9e5f041cbecdf6024c96ebdbc08e91a3e017cf43c6bcd3dbeb90843836c89
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
29209
last-modified
Mon, 28 Jan 2019 03:27:38 GMT
server
nginx
etag
"d07935af4e1f7259"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/RDP-attack.jpg>; rel="canonical"
content-length
37370
expires
Wed, 27 Jan 2021 15:27:38 GMT
show_ads.js
pagead2.googlesyndication.com/pagead/
60 KB
23 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/show_ads.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0e9db3309975de0d4286f978e0caa9c730395b4f6da01edb2801a078617278a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
23198
x-xss-protection
1; mode=block
server
cafe
etag
6444865663977509339
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 30 Jan 2019 00:16:41 GMT
Picture1-2.png
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
10 KB
10 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/Picture1-2.png?resize=696%2C194&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
eecbb7c051400b89626d73802fe81d23942f80f5107a45e5880da262c37eeda4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
32212
last-modified
Mon, 28 Jan 2019 03:36:44 GMT
server
nginx
etag
"594f87fbab4285d7"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/Picture1-2.png>; rel="canonical"
content-length
10174
expires
Wed, 27 Jan 2021 15:36:44 GMT
Picture2.png
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
9 KB
9 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/Picture2.png?resize=696%2C204&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
6d87a8646381c2022d653f42ad1129027e5833d99ef606851e60e420d6e13845
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
30227
last-modified
Mon, 28 Jan 2019 03:30:46 GMT
server
nginx
etag
"0da549bd8f3d3252"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/Picture2.png>; rel="canonical"
content-length
9514
expires
Wed, 27 Jan 2021 15:30:46 GMT
Picture3.png
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
13 KB
13 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/Picture3.png?resize=696%2C216&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ade411ee2bbb983198970e81d007cf4db99de60a59def401eeee216c6b2b7b8c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
44039
last-modified
Mon, 28 Jan 2019 03:36:44 GMT
server
nginx
etag
"d2816605348011a8"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/Picture3.png>; rel="canonical"
content-length
13278
expires
Wed, 27 Jan 2021 15:36:44 GMT
Picture4.png
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
13 KB
13 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/Picture4.png?resize=696%2C539&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
015e0cd1d15e2181fd8682e6454f5195e850afd9e5231631322b66c1b4e2a107
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
40280
last-modified
Mon, 28 Jan 2019 03:36:44 GMT
server
nginx
etag
"da9dc88dd10e4a46"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/Picture4.png>; rel="canonical"
content-length
12818
expires
Wed, 27 Jan 2021 15:36:44 GMT
4356ed55170acc8bd28aef1ebbc4b36f
secure.gravatar.com/avatar/
1 KB
2 KB
Image
General
Full URL
https://secure.gravatar.com/avatar/4356ed55170acc8bd28aef1ebbc4b36f?s=96&d=mm&r=g
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT vie 2
date
Wed, 30 Jan 2019 00:16:41 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
access-control-allow-origin
*
source-age
1099805
content-type
image/jpeg
status
200
cache-control
max-age=300
content-disposition
inline; filename="4356ed55170acc8bd28aef1ebbc4b36f.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/4356ed55170acc8bd28aef1ebbc4b36f?s=96&d=mm&r=g>; rel="canonical"
content-length
1528
expires
Wed, 30 Jan 2019 00:21:41 GMT
email-decode.min.js
gbhackers.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
828 B
Script
General
Full URL
https://gbhackers.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

:path
/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
vary
Accept-Encoding
last-modified
Tue, 29 Jan 2019 05:11:37 GMT
server
cloudflare
etag
W/"5c4fe089-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
cache-control
max-age=172800 public
cf-ray
4a0fc054ace363eb-FRA
expires
Fri, 01 Feb 2019 00:16:41 GMT
FaceTime-Bug.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/
5 KB
5 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/FaceTime-Bug.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
ae526835a1de180b2afd7eac838b5d78b203fdb2cdcd50413367ea84d1abd475
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
MISS 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
3800
last-modified
Wed, 30 Jan 2019 00:08:35 GMT
server
nginx
etag
"f49bc77ae56d3c7e"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/FaceTime-Bug.jpg>; rel="canonical"
content-length
5016
expires
Fri, 29 Jan 2021 12:08:35 GMT
xDedic.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/
11 KB
12 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/xDedic.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
1dbf016fdef417ef476f2d20cf3de84fe470863f1f583e13e6842542a07b3509
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
5642
last-modified
Tue, 29 Jan 2019 13:48:48 GMT
server
nginx
etag
"b6114c713f28723e"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/xDedic.jpg>; rel="canonical"
content-length
11614
expires
Fri, 29 Jan 2021 01:48:48 GMT
Hacking-techniques.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/
6 KB
6 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2019/01/Hacking-techniques.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
6b5251cfff94a91ad18bfa72f8441b302b5085a7bdf6c89806d9c5b43eb46fb1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4439
last-modified
Tue, 29 Jan 2019 10:18:18 GMT
server
nginx
etag
"231efabacca9ef58"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/Hacking-techniques.jpg>; rel="canonical"
content-length
6438
expires
Thu, 28 Jan 2021 22:18:18 GMT
0patch.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
4 KB
4 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/0patch.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
65aadb725e95c4a36401c9ad1d35c1e6cf2effcdea680971bc94c2d21443c852
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
3559
last-modified
Tue, 29 Jan 2019 08:45:06 GMT
server
nginx
etag
"087ed8b699fa6243"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/0patch.jpg>; rel="canonical"
content-length
4132
expires
Thu, 28 Jan 2021 20:45:06 GMT
TeamViewer.png
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
6 KB
6 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/TeamViewer.png?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
a3b0d23ba78cb3edbb381bbc6525ea47e13d00b00c29098de7dc1ce40461c414
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
38015
last-modified
Tue, 29 Jan 2019 05:36:46 GMT
server
nginx
etag
"ff46102a6920fff4"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/TeamViewer.png>; rel="canonical"
content-length
6066
expires
Thu, 28 Jan 2021 17:36:46 GMT
l3Jl61548735910.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
5 KB
6 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/l3Jl61548735910.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
8f8143b71ff8abcc002554ced570bd2bc60a0909b2f5f5e02a3c004ef00be7d2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4410
last-modified
Tue, 29 Jan 2019 05:01:05 GMT
server
nginx
etag
"e19c1e82ff1d990b"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/l3Jl61548735910.jpg>; rel="canonical"
content-length
5456
expires
Thu, 28 Jan 2021 17:01:05 GMT
GBHackers-2019-336x280-1.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
20 KB
20 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/GBHackers-2019-336x280-1.jpg?resize=300%2C250&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
1cfe1bf5226d6229308d9ddbb2c3da3cf1c746912792e5f2a63b1e6e92cd99c8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
11011
last-modified
Wed, 16 Jan 2019 09:15:50 GMT
server
nginx
etag
"a7343e3ecd34fe22"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/GBHackers-2019-336x280-1.jpg>; rel="canonical"
content-length
20328
expires
Fri, 15 Jan 2021 21:15:50 GMT
Ethicalhackersacademy.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2018/09/
23 KB
24 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2018/09/Ethicalhackersacademy.jpg?w=300&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
84f8644a6090b03bf1125ccb708e6f331c95e7d03ebe6bd7dc3fb89b16a70bb3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
19357
last-modified
Sun, 30 Sep 2018 19:15:35 GMT
server
nginx
etag
"7de01fb802c8faa2"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/09/Ethicalhackersacademy.jpg>; rel="canonical"
content-length
23932
expires
Wed, 30 Sep 2020 07:15:35 GMT
Operation-Sharpshooter.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2018/12/
2 KB
2 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2018/12/Operation-Sharpshooter.jpg?resize=100%2C70&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
103bc07e00c0e0f647008b19be811834277c05fb6746a4d54d05121e6f2fb996
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
1242
last-modified
Fri, 14 Dec 2018 15:13:24 GMT
server
nginx
etag
"0597ad9ee1d39439"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/12/Operation-Sharpshooter.jpg>; rel="canonical"
content-length
1870
expires
Mon, 14 Dec 2020 03:13:24 GMT
Phishing-Scam.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/
2 KB
2 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/Phishing-Scam.jpg?resize=100%2C70&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
619c136ef4f723ccc45dbdfd5ece84fe725c74b40a5a8ef9675475fab4d1764b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
1327
last-modified
Mon, 22 Oct 2018 08:12:36 GMT
server
nginx
etag
"32a4db4bee6f66c0"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/10/Phishing-Scam.jpg>; rel="canonical"
content-length
2156
expires
Wed, 21 Oct 2020 20:12:36 GMT
Skim-Reaper.png
i2.wp.com/gbhackers.com/wp-content/uploads/2018/08/
2 KB
2 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2018/08/Skim-Reaper.png?resize=100%2C70&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9eeefab8d8c48b393e25c807d92b43976ad433896ef413da638375749e212c5f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
15112
last-modified
Wed, 31 Oct 2018 17:36:30 GMT
server
nginx
etag
"cf07aa16f5591340"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/08/Skim-Reaper.png>; rel="canonical"
content-length
1994
expires
Sat, 31 Oct 2020 05:36:30 GMT
CHqjD1543454711.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/
2 KB
2 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/CHqjD1543454711.jpg?resize=100%2C70&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
e7ca9f4cb758a15dd3b5d4648043fdba34a0007a43dc1f84724fef01e44a7d0a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
1222
last-modified
Thu, 29 Nov 2018 02:07:09 GMT
server
nginx
etag
"5b0c1d2e05e7e636"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/11/CHqjD1543454711.jpg>; rel="canonical"
content-length
2092
expires
Sat, 28 Nov 2020 14:07:09 GMT
Facebook-tracking.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/12/
3 KB
3 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/12/Facebook-tracking.jpg?resize=100%2C70&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
3dfc286927b185a6626f8b2a3e151bd6e59cfc5ab0c061ad20ce541903c877c4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
1360
last-modified
Mon, 31 Dec 2018 03:14:29 GMT
server
nginx
etag
"27de6d9a95ea4358"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/12/Facebook-tracking.jpg>; rel="canonical"
content-length
2604
expires
Wed, 30 Dec 2020 15:14:29 GMT
INTEL.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2017/03/
11 KB
11 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2017/03/INTEL.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
a6bdf21b3af9958cd74d71e803c5644eaba2a7c1020899facbfb98369da1ff85
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
5576
last-modified
Wed, 31 Oct 2018 17:27:33 GMT
server
nginx
etag
"cb6aeaef30c0784a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2017/03/INTEL.jpg>; rel="canonical"
content-length
11118
expires
Sat, 31 Oct 2020 05:27:33 GMT
PCI-Compliance-Checklist.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/
4 KB
5 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/PCI-Compliance-Checklist.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c54b4055523dfd420c9837bf8a3267f939126a4298224a9f104c843d6edab81c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
3975
last-modified
Tue, 06 Nov 2018 12:08:59 GMT
server
nginx
etag
"0744ede488b16cc5"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/11/PCI-Compliance-Checklist.jpg>; rel="canonical"
content-length
4366
expires
Fri, 06 Nov 2020 00:08:59 GMT
malware-campaign.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/05/
7 KB
7 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/05/malware-campaign.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
67eff72745a3f16d3baeed2774e0777f3627fd0fa949c75dbd74436409c0bb02
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4150
last-modified
Wed, 31 Oct 2018 13:18:42 GMT
server
nginx
etag
"91efe33ab9964764"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/05/malware-campaign.jpg>; rel="canonical"
content-length
7116
expires
Sat, 31 Oct 2020 01:18:42 GMT
Malicious-apps.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/11/
9 KB
9 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/11/Malicious-apps.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
a95bc48251d6b365736ed8c395d198c3cc3afa916b86fd848fc7241de0a05e89
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
5154
last-modified
Tue, 20 Nov 2018 04:51:54 GMT
server
nginx
etag
"90cbf1745d0e439c"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/11/Malicious-apps.jpg>; rel="canonical"
content-length
9070
expires
Thu, 19 Nov 2020 16:51:54 GMT
enFyX1547768754.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/
6 KB
6 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2019/01/enFyX1547768754.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
30ada4b8b1cbf2cb4eeb51a14524c150217c6703dc417ed0fbfbb35e61675adf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4731
last-modified
Fri, 18 Jan 2019 00:40:09 GMT
server
nginx
etag
"8ec79abcbc31650d"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/enFyX1547768754.jpg>; rel="canonical"
content-length
6190
expires
Sun, 17 Jan 2021 12:40:09 GMT
Malware-Android.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2017/11/
6 KB
6 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2017/11/Malware-Android.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
b25e6487653b166901c5025ebfdf4ef9cecf2db992143a69b0bcac7b76a97367
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4529
last-modified
Wed, 31 Oct 2018 17:27:36 GMT
server
nginx
etag
"2b9091f845b01694"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2017/11/Malware-Android.jpg>; rel="canonical"
content-length
5688
expires
Sat, 31 Oct 2020 05:27:36 GMT
ISR.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/
9 KB
9 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/11/ISR.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
cc40d7efa491425892a1563f4fbab0d93187151408ae8b70d30dd748a1edd0fc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4902
last-modified
Tue, 13 Nov 2018 11:37:12 GMT
server
nginx
etag
"981b44375545741e"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/11/ISR.jpg>; rel="canonical"
content-length
9386
expires
Thu, 12 Nov 2020 23:37:12 GMT
imFHz1545507978.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/12/
3 KB
3 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/12/imFHz1545507978.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
c8b8b9e88c727a9db2ab2b4131c4ca6d8126b3cb5afbd6da7cde3827deb97e20
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
2463
last-modified
Sun, 23 Dec 2018 04:53:28 GMT
server
nginx
etag
"06de5c3031c18a0a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/12/imFHz1545507978.jpg>; rel="canonical"
content-length
3328
expires
Tue, 22 Dec 2020 16:53:28 GMT
25-Malicious-apps-1.png
i2.wp.com/gbhackers.com/wp-content/uploads/2018/09/
6 KB
6 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2018/09/25-Malicious-apps-1.png?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
7d412bb69f12fea87bdbd3cb64d66d2251a8757e2840534c0ed339c4911cc0ab
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
23634
last-modified
Wed, 31 Oct 2018 11:49:48 GMT
server
nginx
etag
"ad1d7542cf642053"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/09/25-Malicious-apps-1.png>; rel="canonical"
content-length
6452
expires
Fri, 30 Oct 2020 23:49:48 GMT
financial-information.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2019/01/
10 KB
10 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2019/01/financial-information.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
e465f316b67222de2b69b83471f1a8f5da6a814197ffa8d36669b0eb7a93f681
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4985
last-modified
Thu, 24 Jan 2019 17:14:28 GMT
server
nginx
etag
"634228f24423f0ea"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2019/01/financial-information.jpg>; rel="canonical"
content-length
10142
expires
Sun, 24 Jan 2021 05:14:28 GMT
MU4uZ1515238367.png
i0.wp.com/gbhackers.com/wp-content/uploads/2018/01/
8 KB
8 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/01/MU4uZ1515238367.png?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
3e0c76b740c8abc090c41603a292e6f7b25e35c4574f43980c6f3e152edb3431
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
37455
last-modified
Wed, 31 Oct 2018 17:28:32 GMT
server
nginx
etag
"92f5bb6c4ca3898a"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/01/MU4uZ1515238367.png>; rel="canonical"
content-length
8212
expires
Sat, 31 Oct 2020 05:28:32 GMT
DRONE.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/10/
4 KB
4 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/10/DRONE.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
5a53da4f325024a7df309f2f7ad901999c928e2854b11b57c7ef36027844b71d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
2348
last-modified
Wed, 24 Oct 2018 19:28:43 GMT
server
nginx
etag
"8305c23b1b4067ee"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/10/DRONE.jpg>; rel="canonical"
content-length
4366
expires
Sat, 24 Oct 2020 07:28:43 GMT
whatsapp.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2017/02/
5 KB
5 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2017/02/whatsapp.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
96468d7826da15507982e7c0ae01ec5d483373ae2f720e9fb6fe349a57b3c23a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
last-modified
Fri, 07 Sep 2018 00:26:16 GMT
server
nginx
etag
"0cc428d68b1a6666"
vary
Accept
content-type
image/jpeg
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2017/02/whatsapp.jpg>; rel="canonical"
content-length
5254
expires
Sun, 06 Sep 2020 12:26:16 GMT
Expensivewall_GBHackers.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2017/09/
9 KB
9 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2017/09/Expensivewall_GBHackers.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
08dce5e54b3d99d6e8e53326060aeadb430b8eb76ec88d3d92764f349e806eb8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
4603
last-modified
Wed, 31 Oct 2018 17:27:37 GMT
server
nginx
etag
"f8b039ed7219d59f"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2017/09/Expensivewall_GBHackers.jpg>; rel="canonical"
content-length
8822
expires
Sat, 31 Oct 2020 05:27:37 GMT
Homeland-Security-Technologies.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/
1 KB
2 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/Homeland-Security-Technologies.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
206ae51c56d61d39da97276f90eb4da3ef7ded2a72385e84a0926b7aef7696f4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
1341
last-modified
Wed, 24 Oct 2018 19:03:31 GMT
server
nginx
etag
"d5756eb2380a875c"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/10/Homeland-Security-Technologies.jpg>; rel="canonical"
content-length
1440
expires
Sat, 24 Oct 2020 07:03:31 GMT
Data-protection.jpg
i2.wp.com/gbhackers.com/wp-content/uploads/2018/03/
6 KB
6 KB
Image
General
Full URL
https://i2.wp.com/gbhackers.com/wp-content/uploads/2018/03/Data-protection.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
77eea2711d3da1b7bd371acfcbf2991fae27767b783c57629070dd04c9944974
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
3763
last-modified
Fri, 07 Sep 2018 00:26:17 GMT
server
nginx
etag
"9b37da0925c85a8f"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/03/Data-protection.jpg>; rel="canonical"
content-length
6256
expires
Sun, 06 Sep 2020 12:26:17 GMT
VPN-for-Streaming.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/
10 KB
10 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/10/VPN-for-Streaming.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
220bf350639cf4d99d23619fb4f48d3b90d55daa2dfd890972d1e7f4fa6c8ba8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 21
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
6262
last-modified
Tue, 30 Oct 2018 11:42:34 GMT
server
nginx
etag
"5279281196069d55"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/10/VPN-for-Streaming.jpg>; rel="canonical"
content-length
10510
expires
Thu, 29 Oct 2020 23:42:34 GMT
Exploit-Kit.png
i1.wp.com/gbhackers.com/wp-content/uploads/2018/04/
9 KB
9 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/04/Exploit-Kit.png?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
81f2d81a434a2300f04914f854f0e9f887770287d592b5d1f3ac7e7c665878e2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 20
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
46808
last-modified
Tue, 30 Oct 2018 08:07:32 GMT
server
nginx
etag
"aff97e1dcbd2a791"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/04/Exploit-Kit.png>; rel="canonical"
content-length
8864
expires
Thu, 29 Oct 2020 20:07:32 GMT
XbhVc1529786460.jpg
i1.wp.com/gbhackers.com/wp-content/uploads/2018/06/
8 KB
9 KB
Image
General
Full URL
https://i1.wp.com/gbhackers.com/wp-content/uploads/2018/06/XbhVc1529786460.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
39bdcc7ba67e039445ea5b550f9ee47b05eff1db9287310d52a413482401c30b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 16
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
5360
last-modified
Wed, 31 Oct 2018 17:27:36 GMT
server
nginx
etag
"37f9cf66c05fbec8"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/06/XbhVc1529786460.jpg>; rel="canonical"
content-length
8650
expires
Sat, 31 Oct 2020 05:27:36 GMT
malicious-apps-reappeared.jpg
i0.wp.com/gbhackers.com/wp-content/uploads/2018/05/
9 KB
10 KB
Image
General
Full URL
https://i0.wp.com/gbhackers.com/wp-content/uploads/2018/05/malicious-apps-reappeared.jpg?resize=218%2C150&ssl=1
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
dcb8bec7b4d5f91cece9aceddc345a99895b2ed045b751ca47107e47abbe1ca9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 17
date
Wed, 30 Jan 2019 00:16:41 GMT
x-content-type-options
nosniff
x-bytes-saved
5644
last-modified
Wed, 31 Oct 2018 17:27:38 GMT
server
nginx
etag
"166b25ea4532b05f"
vary
Accept
content-type
image/webp
status
200
cache-control
public, max-age=63115200
link
<https://gbhackers.com/wp-content/uploads/2018/05/malicious-apps-reappeared.jpg>; rel="canonical"
content-length
9654
expires
Sat, 31 Oct 2020 05:27:38 GMT
devicepx-jetpack.js
s0.wp.com/wp-content/js/
10 KB
3 KB
Script
General
Full URL
https://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201905
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT 5am 32
date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
server
nginx
etag
W/"5867460b-52b6"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
x-ac
4.5am _dfw
expires
Mon, 27 Jan 2020 00:18:12 GMT
e-201905.js
stats.wp.com/
8 KB
3 KB
Script
General
Full URL
https://stats.wp.com/e-201905.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
32055d9b971d8d2401fef1314f3ab521670dc4d913c65e27279aaa0b85f57e5e

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
server
nginx
etag
W/"5bffef4d-331d"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=31536000
expires
Mon, 27 Jan 2020 00:18:15 GMT
autoptimize_494261d3420d801f2da2c77a8afea725.js
gbhackers.com/wp-content/cache/autoptimize/js/
231 KB
54 KB
Script
General
Full URL
https://gbhackers.com/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca7f1f03340f5d81dda5914ae4786ddbdb6c4da388d4afab2e3643eb614549d1
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
br
cf-cache-status
HIT
cf-polished
origSize=237000
cf-ray
4a0fc0550d1663eb-FRA
x-cache
HIT
status
200
last-modified
Sat, 12 Jan 2019 03:06:05 GMT
x-cache-hits
1
x-xss-protection
1; mode=block
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-varnish
394694 1245841
cache-control
public, max-age=30672000
content-type
application/javascript
expires
Mon, 20 Jan 2020 00:16:41 GMT
wp-emoji-release.min.js
gbhackers.com/wp-includes/js/
12 KB
4 KB
Script
General
Full URL
https://gbhackers.com/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
:scheme
https
:method
GET
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
br
cf-cache-status
HIT
cf-ray
4a0fc0550d1763eb-FRA
x-cache
HIT
status
200
x-cache-hits
2
x-xss-protection
1; mode=block
last-modified
Thu, 02 Aug 2018 21:51:55 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-varnish
2064529 492182
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Thu, 30 Jan 2020 00:16:41 GMT
newspaper.woff
gbhackers.com/wp-content/themes/Newspaper/images/icons/
15 KB
15 KB
Font
General
Full URL
https://gbhackers.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?14
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc7375f568ea439c4f544ac6488b963a8d57d6cd65b0a8a551230d330e55483f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/themes/Newspaper/images/icons/newspaper.woff?14
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397
origin
https://gbhackers.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
Origin
https://gbhackers.com

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
cf-cache-status
HIT
last-modified
Sat, 16 Dec 2017 02:49:51 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-cache
MISS
content-type
font/woff
status
200
cache-control
public, max-age=2592000
x-varnish
3081224
cf-ray
4a0fc0554d4563eb-FRA
x-xss-protection
1; mode=block
expires
Fri, 01 Mar 2019 00:16:41 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Tue, 22 Jan 2019 09:40:34 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:46 GMT
server
sffe
age
657367
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
8892
x-xss-protection
1; mode=block
expires
Wed, 22 Jan 2020 09:40:34 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Wed, 23 Jan 2019 12:56:25 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:39 GMT
server
sffe
age
559216
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
8800
x-xss-protection
1; mode=block
expires
Thu, 23 Jan 2020 12:56:25 GMT
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Mon, 21 Jan 2019 15:44:31 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
age
721930
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
10788
x-xss-protection
1; mode=block
expires
Tue, 21 Jan 2020 15:44:31 GMT
mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
349c9eaeb1ddfca43b899f7479defefa32bb049c49f25c9ccaa6432cf0ffab95
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Thu, 20 Dec 2018 21:59:30 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:48 GMT
server
sffe
age
3464231
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9432
x-xss-protection
1; mode=block
expires
Fri, 20 Dec 2019 21:59:30 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/
10 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Thu, 03 Jan 2019 10:09:38 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:51 GMT
server
sffe
age
2297223
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
10748
x-xss-protection
1; mode=block
expires
Fri, 03 Jan 2020 10:09:38 GMT
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v18/
12 KB
12 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
64565561ddb338a11ffce5b84aa53fa6e8fd203c34208e61eb5602cd08bf527f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Tue, 22 Jan 2019 18:18:01 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:48 GMT
server
sffe
age
626320
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12352
x-xss-protection
1; mode=block
expires
Wed, 22 Jan 2020 18:18:01 GMT
KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Fri, 21 Dec 2018 05:58:03 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:33:03 GMT
server
sffe
age
3435518
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
10764
x-xss-protection
1; mode=block
expires
Sat, 21 Dec 2019 05:58:03 GMT
KFOjCnqEu92Fr1Mu51S7ACc6CsTYl4BO.woff2
fonts.gstatic.com/s/roboto/v18/
12 KB
12 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOjCnqEu92Fr1Mu51S7ACc6CsTYl4BO.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
76d779c16f21b55a95fb182bf7552447ee340d15556e53a99dd789383f6d8c32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Tue, 22 Jan 2019 09:40:36 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
age
657365
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
12416
x-xss-protection
1; mode=block
expires
Wed, 22 Jan 2020 09:40:36 GMT
integrator.js
adservice.google.de/adsid/
109 B
485 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=gbhackers.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/
109 B
323 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=gbhackers.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
application/javascript; charset=UTF-8
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
104
x-xss-protection
1; mode=block
ca-pub-8834194653550774.js
pagead2.googlesyndication.com/pub-config/r20160913/
133 B
277 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-8834194653550774.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 29 Jan 2019 14:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jan 2019 20:05:40 GMT
server
sffe
age
34312
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
125
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 02:44:49 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/
191 KB
71 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
3a0450cdee958151ab0926005cc1bd2e72db85b03055abb2bf27b940d08cfe8b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
72408
x-xss-protection
1; mode=block
server
cafe
etag
8103673704759360682
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 30 Jan 2019 00:16:41 GMT
show_ads_impl.js
pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/ Frame 3096
191 KB
71 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
3a0450cdee958151ab0926005cc1bd2e72db85b03055abb2bf27b940d08cfe8b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
72408
x-xss-protection
1; mode=block
server
cafe
etag
8103673704759360682
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Wed, 30 Jan 2019 00:16:41 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20190128/r20180604/ Frame 25CC
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20190128/r20180604/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/html/r20190128/r20180604/zrt_lookup.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
vary
Accept-Encoding
date
Tue, 29 Jan 2019 09:03:41 GMT
expires
Tue, 12 Feb 2019 09:03:41 GMT
content-type
text/html; charset=UTF-8
etag
14090563764879558401
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
6959
x-xss-protection
1; mode=block
cache-control
public, max-age=1209600
age
54780
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-88811382-1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81c::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
3738
date
Tue, 29 Jan 2019 23:14:23 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
17543
expires
Wed, 30 Jan 2019 01:14:23 GMT
web
onesignal.com/api/v1/sync/a7a25758-844a-4255-9c2f-95ddba8ff4a4/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/a7a25758-844a-4255-9c2f-95ddba8ff4a4/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:cda5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Phusion Passenger 5.3.5
Resource Hash
dd46e6d0d92796ae580ae3462823a6f75a4091a40df93ef3adf7fbec2a03ebef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Phusion Passenger 5.3.5
status
200, 200 OK
vary
Accept-Encoding
x-xss-protection
1; mode=block
x-request-id
90606df2-349c-46c1-aebf-6201e133be9f
x-runtime
0.058516
cf-bgj
minify
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=300
cf-polished
origSize=2567
cf-ray
4a0fc056bec9bf07-FRA
access-control-allow-headers
SDK-Version
expires
Wed, 30 Jan 2019 00:21:42 GMT
pubads_impl_297.js
securepubads.g.doubleclick.net/gpt/
182 KB
63 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_297.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.18.98 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
zrh04s05-in-f98.1e100.net
Software
sffe /
Resource Hash
7f3cbff0c6f099ab4a30194c047557834a23de3897ee100a2b9e634d8dad4dd8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Jan 2019 18:53:43 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
63712
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:42 GMT
truncated
/
18 KB
0
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://gbhackers.com

Response headers

Content-Type
application/font-woff;charset=utf-8
ca-pub-5372786174760228.js
pagead2.googlesyndication.com/pub-config/r20160913/
133 B
233 B
Script
General
Full URL
https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5372786174760228.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81d::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jan 2019 20:04:02 GMT
server
sffe
age
0
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=43200
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
125
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 12:16:42 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j73&a=808268513&t=pageview&_s=1&dl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&ul=en-us&de=UTF-8&dt=Hackers%20Conducting%...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-88811382-1&cid=1111923185.1548807402&jid=1951600793&_gid=44108446.1548807402&gjid=3289225&_v=j73&z=828222605
35 B
102 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-88811382-1&cid=1111923185.1548807402&jid=1951600793&_gid=44108446.1548807402&gjid=3289225&_v=j73&z=828222605
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400c:c04::9b , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
date
Wed, 30 Jan 2019 00:16:42 GMT
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 30 Jan 2019 00:16:42 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-88811382-1&cid=1111923185.1548807402&jid=1951600793&_gid=44108446.1548807402&gjid=3289225&_v=j73&z=828222605
content-type
text/html; charset=UTF-8
status
302
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
414
expires
Fri, 01 Jan 1990 00:00:00 GMT
zerg.js
www.zergnet.com/
2 KB
1 KB
Script
General
Full URL
https://www.zergnet.com/zerg.js?id=68152
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.243.3 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-243-3.compute-1.amazonaws.com
Software
nginx /
Resource Hash
75235ee006188bd1ead67290857a193bd2d68321665f981634136a4ec3299a31

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
expires
Wed, 06 Feb 2019 00:16:42 GMT
server
nginx
content-type
application/javascript; charset=UTF-8
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Thu, 24 Jan 2019 08:16:17 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:48 GMT
server
sffe
age
489625
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
8916
x-xss-protection
1; mode=block
expires
Fri, 24 Jan 2020 08:16:17 GMT
SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
fonts.gstatic.com/s/droidsans/v8/
11 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/droidsans/v8/SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
4f5b85aed9b8ca8cae0a9ca7cd5f7524db2027102a90424319c0535f2a35309c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Sat, 26 Jan 2019 15:59:33 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 18:25:06 GMT
server
sffe
age
289029
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
11292
x-xss-protection
1; mode=block
expires
Sun, 26 Jan 2020 15:59:33 GMT
csscfont.woff2
gbhackers.com/wp-content/plugins/cresta-social-share-counter/font/
6 KB
6 KB
Font
General
Full URL
https://gbhackers.com/wp-content/plugins/cresta-social-share-counter/font/csscfont.woff2?44942080
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6812:2ddf , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3b430a9a8562e5b7052c70030ab9066361efd2b03be07769d5f00a5ef3a1582
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/wp-content/plugins/cresta-social-share-counter/font/csscfont.woff2?44942080
pragma
no-cache
cookie
__cfduid=d014ed96573610922a67a0139939fa3521548807397; _ga=GA1.2.1111923185.1548807402; _gid=GA1.2.44108446.1548807402; _gat_gtag_UA_88811382_1=1
origin
https://gbhackers.com
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
gbhackers.com
referer
https://gbhackers.com/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
:scheme
https
:method
GET
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/wp-content/cache/autoptimize/css/autoptimize_824732f707129ba9237a0714f1cc991d.css
Origin
https://gbhackers.com

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
cf-cache-status
HIT
last-modified
Sat, 29 Sep 2018 06:31:46 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
x-cache
MISS
content-type
font/woff2
status
200
cache-control
public, max-age=2592000
x-varnish
2885273
cf-ray
4a0fc0582e7e63eb-FRA
x-xss-protection
1; mode=block
expires
Fri, 01 Mar 2019 00:16:42 GMT
o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
fonts.gstatic.com/s/notosans/v7/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosans/v7/o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ede8a63ae7f13de45eeb9c9156f791c7ee1d588f931cc54f4d8754154cbd3a52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin
https://gbhackers.com

Response headers

date
Thu, 03 Jan 2019 10:10:28 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 18:25:32 GMT
server
sffe
age
2297174
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9944
x-xss-protection
1; mode=block
expires
Fri, 03 Jan 2020 10:10:28 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 24D1
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8834194653550774&output=html&h=600&slotname=3739790355&adk=2177241702&adf=601649486&w=160&lmt=1548807402&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807401920&bpp=26&bdt=303&fdt=335&idt=334&shv=r20190128&cbv=r20180604&saldr=sa&abxe=1&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=9379162794&dssz=37&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1425&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfeE%7C&abl=CF&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2542721524&ifi=1&uci=1.cwusjtdfwb23&fsb=1&xpc=ktOCi903el&p=https%3A//gbhackers.com&dtd=371
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-8834194653550774&output=html&h=600&slotname=3739790355&adk=2177241702&adf=601649486&w=160&lmt=1548807402&guci=1.2.0.0.2.2.0.0&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807401920&bpp=26&bdt=303&fdt=335&idt=334&shv=r20190128&cbv=r20180604&saldr=sa&abxe=1&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=9379162794&dssz=37&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1425&ady=0&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CfeE%7C&abl=CF&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2542721524&ifi=1&uci=1.cwusjtdfwb23&fsb=1&xpc=ktOCi903el&p=https%3A//gbhackers.com&dtd=371
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
46
x-xss-protection
1; mode=block
set-cookie
test_cookie=CheckForPermission; expires=Wed, 30-Jan-2019 00:31:42 GMT; path=/; domain=.doubleclick.net
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
osd.js
www.googletagservices.com/activeview/js/current/
75 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81c::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
1773dc9aa405f88c112dd6aebfe8ca32bcb2dfb4dfd9095decb289c00b53250f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Jan 2019 12:19:15 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
content-length
28116
x-xss-protection
1; mode=block
expires
Wed, 30 Jan 2019 00:16:42 GMT
count.js
https-gbhackers-com.disqus.com/
1 KB
1 KB
Script
General
Full URL
https://https-gbhackers-com.disqus.com/count.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:43 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
1960381
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Fri, 04 Jan 2019 21:31:02 GMT
Server
nginx
ETag
"5c2fd096-367"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=86400
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
embed.js
https-gbhackers-com.disqus.com/
65 KB
22 KB
Script
General
Full URL
https://https-gbhackers-com.disqus.com/embed.js
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
openresty /
Resource Hash
de3a560f96044168cf3abd95d788081866a8d56d5ff085adec38ff2b8f126f7a
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:42 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Connection
keep-alive
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
21954
memnYaGs126MiZpBA-UFUKXGUdhrIqOxjaPX.woff2
fonts.gstatic.com/s/opensans/v15/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v15/memnYaGs126MiZpBA-UFUKXGUdhrIqOxjaPX.woff2
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:821::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
eddd570b5f00d47fee36343bade86dcb0ab86a2c30dedcde3f58504d2a8569dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C400italic%2C500%2C500italic%2C700%2C900%7CDroid+Sans%3A400%7COpen+Sans%3A300italic%2C400%2C400italic%2C600%2C600italic%2C700&ver=8.5.1
Origin
https://gbhackers.com

Response headers

date
Thu, 20 Dec 2018 21:43:55 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:54 GMT
server
sffe
age
3465167
content-type
font/woff2
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-origin
*
content-length
9412
x-xss-protection
1; mode=block
expires
Fri, 20 Dec 2019 21:43:55 GMT
count.json
api.pinterest.com/v1/urls/
116 B
523 B
Script
General
Full URL
https://api.pinterest.com/v1/urls/count.json?callback=WPCOMSharing.update_pinterest_count&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&_=1548807401745
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.210.248.189 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-210-248-189.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1ffba32fa3355b719cc1ec0857f5374bb932592bfbc8c1a4941ac87ea82c3f83
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:42 GMT
x-content-type-options
nosniff
X-CDN
akamai
Age
0
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
private
x-envoy-upstream-service-time
2
Connection
keep-alive
Content-Length
116
x-pinterest-rid
279815817272
Expires
Wed, 30 Jan 2019 00:31:42 GMT
/
graph.facebook.com/
677 B
737 B
Script
General
Full URL
https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&_=1548807401746
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
121c0fccc76d22e4d1c6fb7383a96280eebfbfcf9e342c3b0d4d00de26abc929
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
br
x-app-usage
{"call_count":0,"total_cputime":0,"total_time":0}
status
200
date
Wed, 30 Jan 2019 00:16:42 GMT
x-fb-rev
4720021
content-length
325
pragma
no-cache
x-fb-debug
AcMcota+QoiAJ+GiqmDvU+k6rk8t0Eg8EbBKQVef0wx4K0g1xnK7ZpaxcOuWJAEX+9VQ1RTkVAlqiJgN1VWLZA==
x-fb-trace-id
HW2/JpCP6qD
etag
"8addc7a69861e761a2f995e8d4cf87f98ae680d1"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
facebook-api-version
v2.8
expires
Sat, 01 Jan 2000 00:00:00 GMT
g.gif
pixel.wp.com/
50 B
115 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=pinterest&r=0.3444178039713841
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
g.gif
pixel.wp.com/
50 B
74 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.44411404282086164
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
ads
googleads.g.doubleclick.net/pagead/ Frame E12C
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=7425084999&adk=4082770917&adf=193766564&w=728&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402068&bpp=19&bdt=452&fdt=384&idt=186&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=599&ady=56&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&ppjl=u&pfx=0&fu=16&bc=15&osw_key=970116236&ifi=2&uci=2.nexguga1tqtz&fsb=1&xpc=Pk0S8hOPTQ&p=https%3A//gbhackers.com&dtd=427
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=7425084999&adk=4082770917&adf=193766564&w=728&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=728x90&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402068&bpp=19&bdt=452&fdt=384&idt=186&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=2&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=599&ady=56&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&ppjl=u&pfx=0&fu=16&bc=15&osw_key=970116236&ifi=2&uci=2.nexguga1tqtz&fsb=1&xpc=Pk0S8hOPTQ&p=https%3A//gbhackers.com&dtd=427
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
15932
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUlRWohf80BWwWxCSwmOzn1bhVvoyIaa6Oj9CiorFuMP82-fAgdH3qTld8q1; expires=Mon, 24-Feb-2020 00:16:42 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
g.gif
pixel.wp.com/
50 B
74 B
Image
General
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A6.9&blog=116523949&post=26813&tz=0&srv=gbhackers.com&host=gbhackers.com&ref=&rand=0.1795003866070113
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
ads
googleads.g.doubleclick.net/pagead/ Frame 3151
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=8042110665&adk=1636884126&adf=1188380921&w=696&fwrn=4&lmt=1548807402&rafmt=10&guci=1.2.0.0.2.2.0.0&format=696x90_0ads_al&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1548807402087&bpp=6&bdt=470&fdt=473&idt=167&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=621&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=846765324&ifi=3&uci=3.1zbsw3cz96la&fsb=1&xpc=jQOJRUS7Cb&p=https%3A//gbhackers.com&dtd=479
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5372786174760228&output=html&h=90&slotname=8042110665&adk=1636884126&adf=1188380921&w=696&fwrn=4&lmt=1548807402&rafmt=10&guci=1.2.0.0.2.2.0.0&format=696x90_0ads_al&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&fwr=0&wgl=1&adsid=NT&dt=1548807402087&bpp=6&bdt=470&fdt=473&idt=167&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=150341748435587&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=621&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=846765324&ifi=3&uci=3.1zbsw3cz96la&fsb=1&xpc=jQOJRUS7Cb&p=https%3A//gbhackers.com&dtd=479
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
5300
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUm5YP6C4CsXitygP_io2kscDzfaGwH79lzVjsIRmHHalL-DOtueBh-Z2oN8; expires=Mon, 24-Feb-2020 00:16:42 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
output.js
www.zergnet.com/
5 KB
2 KB
Script
General
Full URL
https://www.zergnet.com/output.js?id=68152&time=1548807402573&callback=json4095940
Requested by
Host: www.zergnet.com
URL: https://www.zergnet.com/zerg.js?id=68152
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.243.3 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-198-243-3.compute-1.amazonaws.com
Software
nginx /
Resource Hash
237e95db535de7ffaf086e6696212b79561ecb06d3af1a48b429f3e859c7feda

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
server
nginx
p3p
CP="ZergNet does not have a P3P policy. Learn why here: http://www.zergnet.com/p3p"
status
200
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
application/javascript; charset=UTF-8
expires
Mon, 26 Jul 1997 05:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame 6C3D
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=1238950596&adk=3942814845&adf=1822826330&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402093&bpp=4&bdt=477&fdt=495&idt=161&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=1316&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2837082468&ifi=4&uci=4.fo27eoyiezu3&fsb=1&xpc=p82iN14iAi&p=https%3A//gbhackers.com&dtd=499
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=1238950596&adk=3942814845&adf=1822826330&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402093&bpp=4&bdt=477&fdt=495&idt=161&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=1316&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=2837082468&ifi=4&uci=4.fo27eoyiezu3&fsb=1&xpc=p82iN14iAi&p=https%3A//gbhackers.com&dtd=499
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
12422
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUnVngZtwWTXAx5-MRleGoov48Rr2m3kr0DBo1cycRXs5VF1eO7L4Debi6Nb; expires=Mon, 24-Feb-2020 00:16:42 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame FBEB
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=174&slotname=9047224592&adk=1901560027&adf=2977663563&w=696&fwrn=4&lmt=1548807402&rafmt=11&guci=1.2.0.0.2.2.0.0&format=696x174&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402097&bpp=6&bdt=480&fdt=541&idt=157&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&rplot=4&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=1920&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=2565238555&ifi=5&uci=5.1eep1gqq8xtw&fsb=1&xpc=18SOftqFAh&p=https%3A//gbhackers.com&dtd=545
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5372786174760228&output=html&h=174&slotname=9047224592&adk=1901560027&adf=2977663563&w=696&fwrn=4&lmt=1548807402&rafmt=11&guci=1.2.0.0.2.2.0.0&format=696x174&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&wgl=1&adsid=NT&dt=1548807402097&bpp=6&bdt=480&fdt=541&idt=157&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=55&mdo=0&mso=0&rplot=4&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=259&ady=1920&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=144&bc=15&osw_key=2565238555&ifi=5&uci=5.1eep1gqq8xtw&fsb=1&xpc=18SOftqFAh&p=https%3A//gbhackers.com&dtd=545
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
access-control-expose-headers
x-google-amp-ad-validated-version
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
26514
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUlVuEBcEyR-yF3yqi2juy2e5IRfYqxeP7wP7cmmdFj_Z-1ub8iG8LueV5rI; expires=Mon, 24-Feb-2020 00:16:42 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
ads
googleads.g.doubleclick.net/pagead/ Frame F33E
0
0
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=2715683798&adk=1367495304&adf=3022620766&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402103&bpp=3&bdt=487&fdt=549&idt=151&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250%2C696x174&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=54&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=4377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=1490544511&ifi=6&uci=6.vpxxg6lefsak&fsb=1&xpc=2tuEQDdaQQ&p=https%3A//gbhackers.com&dtd=553
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
googleads.g.doubleclick.net
:scheme
https
:path
/pagead/ads?client=ca-pub-5372786174760228&output=html&h=250&slotname=2715683798&adk=1367495304&adf=3022620766&w=300&lmt=1548807402&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&flash=0&avail_w=696&wgl=1&adsid=NT&dt=1548807402103&bpp=3&bdt=487&fdt=549&idt=151&shv=r20190128&cbv=r20180604&saldr=aa&abxe=1&prev_fmts=728x90%2C696x90_0ads_al%2C300x250%2C696x174&prev_slotnames=3739790355&correlator=44339773320&frm=20&pv=1&ga_vid=1111923185.1548807402&ga_sid=1548807402&ga_hid=808268513&ga_fc=0&iag=0&icsg=601366993218179&dssz=54&mdo=0&mso=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=457&ady=4377&biw=1585&bih=1200&scr_x=0&scr_y=0&eid=21060853&oid=3&rx=0&eae=0&fc=656&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&ppjl=u&pfx=0&fu=16&bc=15&osw_key=1490544511&ifi=6&uci=6.vpxxg6lefsak&fsb=1&xpc=2tuEQDdaQQ&p=https%3A//gbhackers.com&dtd=553
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
accept-encoding
gzip, deflate, br
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
br
date
Wed, 30 Jan 2019 00:16:42 GMT
server
cafe
content-length
327
x-xss-protection
1; mode=block
set-cookie
IDE=AHWqTUkKpXPJ8TExtmjawJBgNMOHrxgSkyi8Q3TMyrEcA1nYXKD6jRuq8HI_QwbO; expires=Mon, 24-Feb-2020 00:16:42 GMT; path=/; domain=.doubleclick.net; HttpOnly test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39",quic=":443"; ma=2592000; v="44,43,39"
expires
Wed, 30 Jan 2019 00:16:42 GMT
cache-control
private
2882329_300.jpg
img2.zergnet.com/
17 KB
18 KB
Image
General
Full URL
https://img2.zergnet.com/2882329_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.59 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-59.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2a53f28177811d93c6eace639bf6bfb89126f2bce66cdce3f7fbf116dfff4b1c

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 05 Jul 2018 17:38:25 GMT
Via
1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront)
Last-Modified
Thu, 10 May 2018 19:28:49 GMT
Server
AmazonS3
Age
17995098
ETag
"f630e2eeca0d7a8f0e590c4a594c9eee"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17761
X-Amz-Cf-Id
N6SuAhPS4DyBUBpFGXfWGOWS4Sk13n8n0dxGLrJyq1T1Wc_EfrXMdA==
Expires
Fri, 10 May 2019 19:28:48 GMT
2058795_300.jpg
img4.zergnet.com/
16 KB
16 KB
Image
General
Full URL
https://img4.zergnet.com/2058795_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.33 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-33.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
25fe76d49981541980d82177548da74a780933243412af4eb89adf954bda4c6b

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 06 Jul 2018 19:03:35 GMT
Via
1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
Last-Modified
Mon, 18 Sep 2017 15:22:47 GMT
Server
AmazonS3
Age
17903587
ETag
"a4188ea737ed231ab9f1f0427a113d72"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16037
X-Amz-Cf-Id
OxhXaviKZ7tJiYWPeJCVYFp7YHEzYKWII2mJqKcD7CI56VNYNAfSew==
Expires
Tue, 18 Sep 2018 15:22:46 GMT
2900723_300.jpg
img4.zergnet.com/
15 KB
15 KB
Image
General
Full URL
https://img4.zergnet.com/2900723_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.33 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-33.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
32e006b2f330c76f253defdc6f5abe02306172bc03b37513be0d56dbf86d43b7

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 23 Aug 2018 00:43:15 GMT
Via
1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront)
Last-Modified
Wed, 16 May 2018 12:49:08 GMT
Server
AmazonS3
Age
13822408
ETag
"a16cd23fd6611ee801d703d0eb131155"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15100
X-Amz-Cf-Id
ndq2B3d8YSCM291jTf4z01__lg_hW1WMroGNosD08PALGWFUQOj1oQ==
Expires
Thu, 16 May 2019 12:49:07 GMT
3731208_300.jpg
img1.zergnet.com/
18 KB
18 KB
Image
General
Full URL
https://img1.zergnet.com/3731208_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.35.198.65 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-35-198-65.lhr62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e9259291a5d070c87411ed52829f5b07ab1e1641d483b1811c1955bba1bbd8e3

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 25 Jan 2019 18:33:13 GMT
Via
1.1 4bc362c59a07f21706e00e1fe67ba2ff.cloudfront.net (CloudFront)
Last-Modified
Fri, 25 Jan 2019 14:19:03 GMT
Server
AmazonS3
Age
366210
ETag
"e86461790479b1f4fa6fe325a9b6be4b"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
18306
X-Amz-Cf-Id
vK0CX4kGanOJYu0noRqIX5EAin32kNJluoOSTQOkq6dk7kRY6yfGPQ==
Expires
Sat, 25 Jan 2020 14:19:02 GMT
3613623_300.jpg
img4.zergnet.com/
20 KB
20 KB
Image
General
Full URL
https://img4.zergnet.com/3613623_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.33 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-33.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
09f67a4de86f53d35973c202de84f572d9a2aec0ca8416a549317256a0b75d12

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 18 Dec 2018 20:18:43 GMT
Via
1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
Last-Modified
Tue, 18 Dec 2018 19:43:14 GMT
Server
AmazonS3
Age
3643080
ETag
"f82e734e71680b3f2c03ec135ebd25a4"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
20000
X-Amz-Cf-Id
iV48e2mYa4a8Ty_dnz8IHd4rX8CrwJwPYygM4xW9kZnO19JRHzoIwA==
Expires
Wed, 18 Dec 2019 19:43:13 GMT
3549417_300.jpg
img2.zergnet.com/
17 KB
18 KB
Image
General
Full URL
https://img2.zergnet.com/3549417_300.jpg
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.101.59 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-101-59.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
59c05077445aaca71b30f2eb7b298716dc4edc1424a0457814d84553dbcba5af

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 30 Nov 2018 19:53:17 GMT
Via
1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
Last-Modified
Fri, 30 Nov 2018 19:32:55 GMT
Server
AmazonS3
Age
5199806
ETag
"b99a5b5f6ac33d942d92cb3232a53af5"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Cache-Control
max-age=290304000, public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17829
X-Amz-Cf-Id
oUJ4d7z6bA3WoMLgAUIwPumTC6gU4k5MtSnbL7P7NYvH3XnIXSSPYA==
Expires
Sat, 30 Nov 2019 19:32:54 GMT
lounge.d49f53e192b9080ef8880a7c9b24f1c3.css
c.disquscdn.com/next/embed/styles/
102 KB
19 KB
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.d49f53e192b9080ef8880a7c9b24f1c3.css
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8d842dc045c65986e7b50952261d47b62cab35c5829700e90d1965ec11692e3
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4a0fc05bcb91c2a1-FRA
status
200
vary
Accept-Encoding
content-length
19425
x-xss-protection
1; mode=block
last-modified
Fri, 26 Oct 2018 00:31:19 GMT
server
cloudflare
cache-control
max-age=31536000, public, immutable, no-transform
etag
"5bd26057-4be1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=300; includeSubdomains
content-type
text/css; charset=utf-8
access-control-allow-origin
*
fastly-debug-digest
eb1006ce43d6cade1496acb1e51569c1d94dd6f363a0a4e497669b5cee0f6289
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 26 Oct 2019 18:02:22 GMT
common.bundle.c1c826ba467260790d5c05dc3cc453f8.js
c.disquscdn.com/next/embed/
243 KB
81 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/common.bundle.c1c826ba467260790d5c05dc3cc453f8.js
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
75b7d9f02fe08bf87d30c1a47c8474c6079ecd02f2a4e3b85b3fa3c883c3205d
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4a0fc05bcb92c2a1-FRA
status
200
vary
Accept-Encoding
content-length
82964
x-xss-protection
1; mode=block
last-modified
Tue, 22 Jan 2019 19:59:35 GMT
server
cloudflare
cache-control
max-age=31536000, public, immutable, no-transform
etag
"5c477627-14414"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=300; includeSubdomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
fastly-debug-digest
ff36d69c08d873c20a36e3fa0c5722a235818b567a6fcccaded4193bddedd30f
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 25 Jan 2020 22:31:30 GMT
lounge.bundle.c8f0dc192ba789fde18d281769beb36d.js
c.disquscdn.com/next/embed/
385 KB
99 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.c8f0dc192ba789fde18d281769beb36d.js
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9369cc851cfc08362445c55d0f49e8de0cade2b150f5b59f20517bbdcc03e17
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4a0fc05bcb93c2a1-FRA
status
200
vary
Accept-Encoding
content-length
101573
x-xss-protection
1; mode=block
last-modified
Tue, 22 Jan 2019 19:59:35 GMT
server
cloudflare
cache-control
max-age=31536000, public, immutable, no-transform
etag
"5c477627-18cc5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=300; includeSubdomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
fastly-debug-digest
9569d0bd447d9eb6fe809326f5062951ae781590dda9517d193ce9e1c172e091
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 25 Jan 2020 22:31:30 GMT
config.js
disqus.com/next/
6 KB
3 KB
Script
General
Full URL
https://disqus.com/next/config.js
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
5a4f584beaca63e69a1ffa50652da9c5d1702ef40b104b401dba35bb64a3c226
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:42 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
4
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
2631
X-XSS-Protection
1; mode=block
Server
nginx
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Timing-Allow-Origin
*
/
disqus.com/embed/comments/ Frame A80C
0
0
Document
General
Full URL
https://disqus.com/embed/comments/?base=default&f=https-gbhackers-com&t_i=26813%20https%3A%2F%2Fgbhackers.com%2F%3Fp%3D26813&t_u=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&t_e=Hackers%20Conducting%20RDP%20Attacks%20Using%20New%20Technique%20to%20Bypass%20Protections&t_d=Hackers%20Conducting%20New%20RDP%20Attack%20That%20Bypass%20Protection&t_t=Hackers%20Conducting%20RDP%20Attacks%20Using%20New%20Technique%20to%20Bypass%20Protections&s_o=default
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

Server
nginx
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Type
text/html; charset=utf-8
Last-Modified
Mon, 28 Jan 2019 03:25:52 GMT
ETag
W/"lounge:view:7193066859.26d87fa9d8b055e7e753c562d6a106e5.2"
Content-Encoding
gzip
Content-Length
2654
Date
Wed, 30 Jan 2019 00:16:43 GMT
Age
0
Connection
keep-alive
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
/
disqusads.com/ads-iframe/taboola/ Frame 229E
0
0
Document
General
Full URL
https://disqusads.com/ads-iframe/taboola/?category=tech&display_bidding_enabled=0&stories_allowed=0&service=dynamic&position=bottom&display_allowed=0&video_allowed=0&provider=taboola&thumbnails_allowed=1&experiment=network_default&variant=fallthrough&display_only=0&sandbox_display=1&links_allowed=1&doublewide_allowed=1&shortname=https-gbhackers-com&forum_pk=4725420&forum_shortname=https-gbhackers-com&safetylevel=30&t=1548807402&anchorColor=%2300a382&colorScheme=light&sourceUrl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&disqus_version=78d9b83
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.0.233 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
openresty /
Resource Hash

Request headers

Host
disqusads.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/

Response headers

Server
openresty
Content-Type
text/html; charset=utf-8
Cache-Control
public, max-age=300
X-Service
router
Content-Encoding
gzip
Content-Length
5208
Date
Wed, 30 Jan 2019 00:16:43 GMT
Age
0
Connection
keep-alive
Vary
Accept-Encoding
event.gif
referrer.disqus.com/juggler/
43 B
229 B
Image
General
Full URL
https://referrer.disqus.com/juggler/event.gif?imp=853g10918q1iii&experiment=network_default&variant=fallthrough&service=dynamic&area=bottom&product=embed&forum=https-gbhackers-com&zone=thread&version=598e4ac0f99187bfe3fea5e0e581031d&page_url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&page_referrer=&object_type=provider&provider=taboola&event=activity&advertisement_id=184193&ad_product_name=iab_display&ad_product_layout=iab_display&bin=embed%3Apromoted_discovery%3Adynamic%3Anetwork_default%3Afallthrough&object_id=taboola&section=default&verb=call&adjective=1&forum_id=4725420
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:43 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
amp4ads-host-v0.js
cdn.ampproject.org/rtv/011901222107370/
19 KB
8 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/011901222107370/amp4ads-host-v0.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20190128/r20180604/show_ads_impl.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:820::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
bd5a5f5569096009ede3c966ea788cd96095d0db3c38c1d8ed3b625d7e79cc81
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding
gzip
x-content-type-options
nosniff
age
108358
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39"
content-length
7808
x-xss-protection
1; mode=block
server
sffe
date
Mon, 28 Jan 2019 18:10:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"abe4f7aea5c0afa0"
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 28 Jan 2020 18:10:45 GMT
realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame D188
337 B
437 B
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4a0fc05f6965c2a1-FRA
status
200
vary
Accept-Encoding
content-length
244
x-xss-protection
1; mode=block
last-modified
Fri, 02 Nov 2018 00:21:20 GMT
server
cloudflare
cache-control
max-age=31536000, public, immutable, no-transform
etag
"5bdb9880-f4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=300; includeSubdomains
content-type
text/css; charset=utf-8
access-control-allow-origin
*
fastly-debug-digest
ddbb547324842fbef412f9cb6a75e494efb72ac30deb102492dc2845863dccf3
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Nov 2019 10:18:08 GMT
realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame CDB8
337 B
309 B
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Requested by
Host: https-gbhackers-com.disqus.com
URL: https://https-gbhackers-com.disqus.com/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:4fa6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 30 Jan 2019 00:16:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
cf-ray
4a0fc05f8984c2a1-FRA
status
200
vary
Accept-Encoding
content-length
244
x-xss-protection
1; mode=block
last-modified
Fri, 02 Nov 2018 00:21:20 GMT
server
cloudflare
cache-control
max-age=31536000, public, immutable, no-transform
etag
"5bdb9880-f4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=300; includeSubdomains
content-type
text/css; charset=utf-8
access-control-allow-origin
*
fastly-debug-digest
ddbb547324842fbef412f9cb6a75e494efb72ac30deb102492dc2845863dccf3
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Nov 2019 10:18:08 GMT
event.gif
referrer.disqus.com/juggler/
43 B
229 B
Image
General
Full URL
https://referrer.disqus.com/juggler/event.gif?imp=853g10918q1iii&experiment=network_default&variant=fallthrough&service=dynamic&area=bottom&product=embed&forum=https-gbhackers-com&zone=thread&version=598e4ac0f99187bfe3fea5e0e581031d&page_url=https%3A%2F%2Fgbhackers.com%2Fthreat-actors-conducting-rdp-attacks%2F&page_referrer=&object_type=advertisement&provider=taboola&event=activity&advertisement_id=184193&ad_product_name=iab_display&ad_product_layout=iab_display&bin=embed%3Apromoted_discovery%3Adynamic%3Anetwork_default%3Afallthrough&object_id=%5B184193%5D&section=default&verb=load&forum_id=4725420
Requested by
Host: gbhackers.com
URL: https://gbhackers.com/threat-actors-conducting-rdp-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.120.134 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://gbhackers.com/threat-actors-conducting-rdp-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 30 Jan 2019 00:16:43 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

319 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| _wpemojiSettings undefined| $ function| jQuery object| cnArgs object| tdwGlobal function| documentInitOneSignal function| OneSignal object| tdBlocksArray function| tdBlock object| tdLocalCache object| td_viewport_interval_list string| td_ajax_url string| td_get_template_directory_uri string| tds_snap_menu string| tds_logo_on_sticky string| tds_header_style string| td_please_wait string| td_email_user_pass_incorrect string| td_email_user_incorrect string| td_email_incorrect string| tds_more_articles_on_post_enable string| tds_more_articles_on_post_time_to_wait number| tds_more_articles_on_post_pages_distance_from_top string| tds_theme_color_site_wide string| tds_smart_sidebar string| tdThemeName string| td_magnific_popup_translation_tPrev string| td_magnific_popup_translation_tNext string| td_magnific_popup_translation_tCounter string| td_magnific_popup_translation_ajax_tError string| td_magnific_popup_translation_image_tError object| tdDateNamesI18n string| td_ad_background_click_link string| td_ad_background_click_target function| gtag object| dataLayer object| googletag object| google_tag_manager number| td_screen_width object| adsbygoogle object| twemoji object| wp object| google_ad_client object| google_ad_slot object| google_ad_width object| google_ad_height object| google_js_reporting_queue object| google_ad_modifications boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| google_onload_fired object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| google_sa_queue object| google_sl_win function| google_process_slots object| google_ad_block object| google_ad_channel object| google_ad_format object| google_ad_host object| google_ad_host_channel object| google_ad_host_tier_id object| google_ad_layout object| google_ad_layout_key object| google_ad_output object| google_ad_region object| google_ad_section object| google_ad_type object| google_ad_unit_key object| google_ad_dom_fingerprint object| google_ad_semantic_area object| google_adtest object| google_allow_expandable_ads object| google_alternate_ad_url object| google_alternate_color object| google_available_width object| google_captcha_token object| google_city object| google_color_bg object| google_color_border object| google_color_line object| google_color_link object| google_color_text object| google_color_url object| google_container_id object| google_content_recommendation_ad_positions object| google_content_recommendation_columns_num object| google_content_recommendation_rows_num object| google_content_recommendation_ui_type object| google_content_recommendation_use_square_imgs object| google_contents object| google_core_dbp object| google_country object| google_cpm object| google_ctr_threshold object| google_cust_age object| google_cust_ch object| google_cust_criteria object| google_cust_gender object| google_cust_id object| google_cust_interests object| google_cust_job object| google_cust_l object| google_cust_lh object| google_cust_u_url object| google_disable_video_autoplay object| google_bfa object| ebfa object| ebfana object| ebfaca object| google_eids object| google_enable_content_recommendations object| google_enable_ose object| google_encoding object| google_font_face object| google_font_size object| google_frame_id object| google_full_width_responsive_allowed object| efwr object| google_full_width_responsive object| gfwroh object| gfwrow object| gfwroml object| gfwromr object| gfwroz object| gfwrnh object| gfwrnwer object| gfwrnher object| google_gl object| google_hints object| google_image_size object| google_kw object| google_kw_type object| google_lact object| google_language object| google_loeid object| google_max_num_ads object| google_max_radlink_len object| google_max_responsive_height object| google_mtl object| google_native_ad_template object| google_native_settings_key object| google_num_radlinks object| google_num_radlinks_per_unit object| google_only_pyv_ads object| google_override_format object| google_page_url object| google_pgb_reactive object| google_pucrd object| google_referrer_url object| google_region object| google_resizing_allowed object| google_resizing_height object| google_resizing_width object| rpe object| rpeua object| google_responsive_formats object| google_responsive_auto_format object| google_rl_dest_url object| google_rl_filtering object| google_rl_mode object| google_rt object| google_safe object| google_safe_for_responsive_override object| google_scs object| google_source_type object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_tag_origin object| google_tag_partner object| google_targeting object| google_tfs object| google_video_doc_id object| google_video_product_type object| google_video_url_to_fetch object| google_webgl_support object| google_yt_pt object| google_yt_up object| google_package object| google_debug_params object| google_enable_single_iframe object| google_sv_map object| google_t12n_vars string| GoogleAnalyticsObject function| ga number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| closure_memoize_cache_ function| google_spfd number| google_lpabyc object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| block_td_uid_5_5c50ece7c95ec object| block_td_uid_9_5c50ece7dcb2f object| block_td_uid_10_5c50ece7ef317 function| google_sa_impl object| google_jobrunner object| google_persistent_state_async object| google_pub_config object| __google_ad_urls number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| google_iframe_oncopy function| Goog_AdSense_getAdAdapterInstance boolean| google_osd_loaded object| GPT_jstiming object| WPCOM_sharing_counts object| countVars object| embedVars object| es_widget_page_notices object| wpcom_img_zoomer object| detectZoom object| sharing_js_options undefined| windowOpen object| _stq object| jQuery11240016572315828678796 string| disqus_shortname string| disqus_url string| disqus_identifier string| disqus_container_id string| disqus_title undefined| disqus_config_custom function| disqus_config function| ES object| tdDetect object| tdViewport object| tdMenu object| tdUtil object| tdAffix function| td_smart_list_dropdown object| td_more_articles_box undefined| td_resize_timer_id function| td_done_resizing function| td_resize_videos function| td_mobile_menu function| td_mobile_menu_toogle function| td_retina function| td_read_site_cookie function| td_set_cookies_life boolean| tdIsScrollingAnimation boolean| td_mouse_wheel_or_touch_moved boolean| td_scroll_to_top_is_visible function| td_events_scroll_scroll_to_top function| td_post_template_6_title function| td_smart_lists_magnific_popup function| td_get_document_width function| td_get_document_height function| setMenuMinHeight function| td_comments_form_validation function| td_scroll_to_class object| tdLoadingBox object| tdAjaxSearch string| tdModalImageLastEl function| tdModalImage object| tdBlocks object| tdLogin object| tdLoginMob object| tdDemoMenu object| tdTrendingNow object| td_history object| tdSmartSidebar object| tdInfiniteLoader function| Froogaloop object| tdCustomEvents object| tdEvents object| tdAjaxCount object| tdYoutubePlayers object| tdVimeoPlayers function| td_resize_smartlist_slides function| td_resize_smartlist_sliders_and_update function| td_resize_normal_slide function| td_resize_normal_slide_and_update object| tdPullDown object| td_fps object| tdAnimationScroll object| tdHomepageFull object| tdBackstr object| tdAnimationStack object| td_backstretch_items function| td_compute_parallax_background function| td_compute_backstretch_item object| tdAjaxLoop object| tdWeather object| tdAnimationSprite function| td_date_i18n object| addComment object| WPCOMSharing object| es function| $f boolean| google_noFetch boolean| google_DisableInitialLoad function| st_go function| linktracker_init object| wpcom object| ZERG function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| json4095940 object| DISQUS object| AMP_CONFIG object| log object| AMPErrors boolean| ampInaboxInitialized object| AMP_MODE function| reportError object| AMP object| DISQUSWIDGETS undefined| disqus_domain

12 Cookies

Domain/Path Name / Value
.taboola.com/ Name: __cfduid
Value: db6f18f32cb7368e0d449ed69aa22a5791548807403
.taboola.com/ Name: t_gid
Value: 203c1ce3-fbe6-438d-8a97-1968e0489cd8-tuct34a726b
disqusads.com/ Name: trc_cookie_storage
Value: disqus-widget-safetylevel20longtail09%253Asession-data%3Dv2_ad24a4b8d98063b0f2b272a22d624c60_203c1ce3-fbe6-438d-8a97-1968e0489cd8-tuct34a726b_1548807403_1548807403_CIi3jgYQktQ_GKXu9eCJLSABKAEwODib4wlAhIoQSKO4GlCj7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522disqus-widget-safetylevel20longtail09%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCwnyMMCwhAELCfIwwLCEIQsJ8jDAsIJBCwnyMMCwgnELCfIwwLCEwQsJ8jDAsILRCwnyMMCwg7ELCfIwwLCD8QsJ8jDAwTFA%7Ctaboola%2520global%253Auser-id%3D203c1ce3-fbe6-438d-8a97-1968e0489cd8-tuct34a726b
.disqus.com/ Name: G_ENABLED_IDPS
Value: google
.google.com/ Name: NID
Value: 156=FRWHMLL1oWC_DBCI56GTKAYfJi538tpwGU5avh-SoP8Js-F8RQvaXcIgzWiKn5_PYOT0FnOByhA2M5GrGKP5bpSPS6TTLX842KZ6-5I_EgEDh-oROw3xSahpZIC-jYXqmHNYsFKOM5t3AwaXqqprKM2IEIPgZuUaR6IvS85Ur2A
.doubleclick.net/ Name: DSID
Value: NO_DATA
.gbhackers.com/ Name: _gat_gtag_UA_88811382_1
Value: 1
.taboola.com/ Name: taboola_usg
Value: GhAQiIFBELWLRRDU6EUQ9KlB
.gbhackers.com/ Name: _gid
Value: GA1.2.44108446.1548807402
.doubleclick.net/ Name: IDE
Value: AHWqTUlVuEBcEyR-yF3yqi2juy2e5IRfYqxeP7wP7cmmdFj_Z-1ub8iG8LueV5rI
.gbhackers.com/ Name: __cfduid
Value: d014ed96573610922a67a0139939fa3521548807397
.gbhackers.com/ Name: _ga
Value: GA1.2.1111923185.1548807402

1 Console Messages

Source Level URL
Text
console-api log URL: https://gbhackers.com/wp-content/cache/autoptimize/js/autoptimize_494261d3420d801f2da2c77a8afea725.js(Line 1)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
api.pinterest.com
c.disquscdn.com
cdn.ampproject.org
cdn.onesignal.com
disqus.com
disqusads.com
fonts.googleapis.com
fonts.gstatic.com
gbhackers.com
googleads.g.doubleclick.net
graph.facebook.com
https-gbhackers-com.disqus.com
i0.wp.com
i1.wp.com
i2.wp.com
img1.zergnet.com
img2.zergnet.com
img4.zergnet.com
onesignal.com
pagead2.googlesyndication.com
pixel.wp.com
referrer.disqus.com
s0.wp.com
secure.gravatar.com
securepubads.g.doubleclick.net
stats.g.doubleclick.net
stats.wp.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.zergnet.com
13.35.198.65
143.204.101.33
143.204.101.59
151.101.0.233
151.101.120.134
151.101.192.134
172.217.18.98
192.0.76.3
192.0.77.2
192.0.77.32
23.210.248.189
2606:4700:30::6812:2ddf
2606:4700::6810:4fa6
2606:4700::6810:cda5
2a00:1450:4001:815::2008
2a00:1450:4001:816::2002
2a00:1450:4001:81b::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::200e
2a00:1450:4001:81d::2002
2a00:1450:4001:81f::200a
2a00:1450:4001:820::2001
2a00:1450:4001:821::2003
2a00:1450:400c:c04::9b
2a03:2880:f01c:800e:face:b00c:0:2
2a04:fa87:fffe::c000:4902
34.198.243.3
015e0cd1d15e2181fd8682e6454f5195e850afd9e5231631322b66c1b4e2a107
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
08dce5e54b3d99d6e8e53326060aeadb430b8eb76ec88d3d92764f349e806eb8
09f67a4de86f53d35973c202de84f572d9a2aec0ca8416a549317256a0b75d12
0be8ba1b272f2e7df3f85e111841fef12cd2e281dc2eda3d1a048e865f728a28
0e9db3309975de0d4286f978e0caa9c730395b4f6da01edb2801a078617278a5
103bc07e00c0e0f647008b19be811834277c05fb6746a4d54d05121e6f2fb996
121c0fccc76d22e4d1c6fb7383a96280eebfbfcf9e342c3b0d4d00de26abc929
148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64
1773dc9aa405f88c112dd6aebfe8ca32bcb2dfb4dfd9095decb289c00b53250f
17bd4bcb69e324586fcc2400c75915b7dfdc25a4ecb96fedd885dbb2fbcbf793
1be216dbc059d96e288b0c1f399a1a80ee8c65e4c1272dbc4574bd6d23cf45d9
1cfe1bf5226d6229308d9ddbb2c3da3cf1c746912792e5f2a63b1e6e92cd99c8
1dbf016fdef417ef476f2d20cf3de84fe470863f1f583e13e6842542a07b3509
1ffba32fa3355b719cc1ec0857f5374bb932592bfbc8c1a4941ac87ea82c3f83
206ae51c56d61d39da97276f90eb4da3ef7ded2a72385e84a0926b7aef7696f4
220bf350639cf4d99d23619fb4f48d3b90d55daa2dfd890972d1e7f4fa6c8ba8
237e95db535de7ffaf086e6696212b79561ecb06d3af1a48b429f3e859c7feda
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25fe76d49981541980d82177548da74a780933243412af4eb89adf954bda4c6b
2a53f28177811d93c6eace639bf6bfb89126f2bce66cdce3f7fbf116dfff4b1c
30ada4b8b1cbf2cb4eeb51a14524c150217c6703dc417ed0fbfbb35e61675adf
32055d9b971d8d2401fef1314f3ab521670dc4d913c65e27279aaa0b85f57e5e
32e006b2f330c76f253defdc6f5abe02306172bc03b37513be0d56dbf86d43b7
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
349c9eaeb1ddfca43b899f7479defefa32bb049c49f25c9ccaa6432cf0ffab95
34e9e5f041cbecdf6024c96ebdbc08e91a3e017cf43c6bcd3dbeb90843836c89
39bdcc7ba67e039445ea5b550f9ee47b05eff1db9287310d52a413482401c30b
3a0450cdee958151ab0926005cc1bd2e72db85b03055abb2bf27b940d08cfe8b
3dfc286927b185a6626f8b2a3e151bd6e59cfc5ab0c061ad20ce541903c877c4
3e0c76b740c8abc090c41603a292e6f7b25e35c4574f43980c6f3e152edb3431
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
41c18139cfaa7d2fc18229a5437b93a878614df5d69e205f18466c8ac571b7c4
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
4899e928e4bfc49a9d7c217d43673490597ea41fe1f2d9a67b424b42bbdbdbd1
4f5b85aed9b8ca8cae0a9ca7cd5f7524db2027102a90424319c0535f2a35309c
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
59c05077445aaca71b30f2eb7b298716dc4edc1424a0457814d84553dbcba5af
5a4f584beaca63e69a1ffa50652da9c5d1702ef40b104b401dba35bb64a3c226
5a53da4f325024a7df309f2f7ad901999c928e2854b11b57c7ef36027844b71d
5c88bebaf4de9d9276e9b8ad07c7e99a9eecef136fc492d87e20cbb05f11d9c0
619c136ef4f723ccc45dbdfd5ece84fe725c74b40a5a8ef9675475fab4d1764b
64565561ddb338a11ffce5b84aa53fa6e8fd203c34208e61eb5602cd08bf527f
65aadb725e95c4a36401c9ad1d35c1e6cf2effcdea680971bc94c2d21443c852
65b7d240d14e3bc948b60dd11e6c582468b9cf2e0ac3e1146a4da5231283a8f4
67eff72745a3f16d3baeed2774e0777f3627fd0fa949c75dbd74436409c0bb02
6b5251cfff94a91ad18bfa72f8441b302b5085a7bdf6c89806d9c5b43eb46fb1
6d87a8646381c2022d653f42ad1129027e5833d99ef606851e60e420d6e13845
75235ee006188bd1ead67290857a193bd2d68321665f981634136a4ec3299a31
75b7d9f02fe08bf87d30c1a47c8474c6079ecd02f2a4e3b85b3fa3c883c3205d
76d779c16f21b55a95fb182bf7552447ee340d15556e53a99dd789383f6d8c32
77eea2711d3da1b7bd371acfcbf2991fae27767b783c57629070dd04c9944974
7d412bb69f12fea87bdbd3cb64d66d2251a8757e2840534c0ed339c4911cc0ab
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
7f3cbff0c6f099ab4a30194c047557834a23de3897ee100a2b9e634d8dad4dd8
81f2d81a434a2300f04914f854f0e9f887770287d592b5d1f3ac7e7c665878e2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84f8644a6090b03bf1125ccb708e6f331c95e7d03ebe6bd7dc3fb89b16a70bb3
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
895964971ebdb56ee76d08850bcb4c5a88ec4c65e6a235882304e8ff6767cd7c
8a4c252da9c4b03a65ca99a734ef82408df893c1b6a5d5a49c4f87f774bc4f75
8f8143b71ff8abcc002554ced570bd2bc60a0909b2f5f5e02a3c004ef00be7d2
96468d7826da15507982e7c0ae01ec5d483373ae2f720e9fb6fe349a57b3c23a
9b15acdd4ca105bbe67c32598b72e1ad2b8e18e2840e3976be9d9f9c93753512
9eeefab8d8c48b393e25c807d92b43976ad433896ef413da638375749e212c5f
a3b0d23ba78cb3edbb381bbc6525ea47e13d00b00c29098de7dc1ce40461c414
a6397fd6239e7596e8cad9932cbdd8a8fd47be6d4a831a29a2ea941c7164a3ae
a6bdf21b3af9958cd74d71e803c5644eaba2a7c1020899facbfb98369da1ff85
a8d842dc045c65986e7b50952261d47b62cab35c5829700e90d1965ec11692e3
a95bc48251d6b365736ed8c395d198c3cc3afa916b86fd848fc7241de0a05e89
ade411ee2bbb983198970e81d007cf4db99de60a59def401eeee216c6b2b7b8c
ae526835a1de180b2afd7eac838b5d78b203fdb2cdcd50413367ea84d1abd475
b25e6487653b166901c5025ebfdf4ef9cecf2db992143a69b0bcac7b76a97367
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
bd5a5f5569096009ede3c966ea788cd96095d0db3c38c1d8ed3b625d7e79cc81
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
c3b430a9a8562e5b7052c70030ab9066361efd2b03be07769d5f00a5ef3a1582
c54b4055523dfd420c9837bf8a3267f939126a4298224a9f104c843d6edab81c
c8b8b9e88c727a9db2ab2b4131c4ca6d8126b3cb5afbd6da7cde3827deb97e20
c9369cc851cfc08362445c55d0f49e8de0cade2b150f5b59f20517bbdcc03e17
ca7f1f03340f5d81dda5914ae4786ddbdb6c4da388d4afab2e3643eb614549d1
cc40d7efa491425892a1563f4fbab0d93187151408ae8b70d30dd748a1edd0fc
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5
d375885e4c44867357619a926d41d98072e018b67ced595e18e38a0bb5aeeee4
dc7375f568ea439c4f544ac6488b963a8d57d6cd65b0a8a551230d330e55483f
dcb8bec7b4d5f91cece9aceddc345a99895b2ed045b751ca47107e47abbe1ca9
dd46e6d0d92796ae580ae3462823a6f75a4091a40df93ef3adf7fbec2a03ebef
de3a560f96044168cf3abd95d788081866a8d56d5ff085adec38ff2b8f126f7a
e465f316b67222de2b69b83471f1a8f5da6a814197ffa8d36669b0eb7a93f681
e7ca9f4cb758a15dd3b5d4648043fdba34a0007a43dc1f84724fef01e44a7d0a
e9259291a5d070c87411ed52829f5b07ab1e1641d483b1811c1955bba1bbd8e3
eddd570b5f00d47fee36343bade86dcb0ab86a2c30dedcde3f58504d2a8569dc
ede8a63ae7f13de45eeb9c9156f791c7ee1d588f931cc54f4d8754154cbd3a52
eecbb7c051400b89626d73802fe81d23942f80f5107a45e5880da262c37eeda4
f2e95b3bfee0ab6c773ba2ff7b64657abfe7f5e942438049cc981f4d37fd029a
f32d41f2099a0be20e6b57c5e0d1b71c079d3e1345827b0f5c5b97c6e5e3f78d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be