redblue42.code42.com Open in urlscan Pro
141.193.213.10 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Submission: On February 07 via api (February 7th 2024, 8:54:38 am UTC) from US — Scanned from DE

Summary HTTP 88 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 31 IPs in 5 countries across 24 domains to perform 88 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is redblue42.code42.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 5th 2023. Valid for: a year.

This is the only time redblue42.code42.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
21	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
8	2a02:26f0:280... 2a02:26f0:280:6::213:7ad8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
10	23.53.42.251 23.53.42.251	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
2	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
1 2	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
1	35.244.142.80 35.244.142.80	15169 (GOOGLE) (GOOGLE)
4	3.77.28.166 3.77.28.166	16509 (AMAZON-02) (AMAZON-02)
1	54.91.171.58 54.91.171.58	14618 (AMAZON-AES) (AMAZON-AES)
1	54.162.0.30 54.162.0.30	14618 (AMAZON-AES) (AMAZON-AES)
1	52.210.29.170 52.210.29.170	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
6	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
1	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:280... 2a02:26f0:280:4::213:7861	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
3	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	52.57.226.31 52.57.226.31	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:400c:c0b::9d	15169 (GOOGLE) (GOOGLE)
88	31

21 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

redblue42.code42.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:280:6::213:7ad8 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 23.53.42.251 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-42-251.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

10192134.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.142.80 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 80.142.244.35.bc.googleusercontent.com

cdn.pdst.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.77.28.166 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.91.171.58 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-91-171-58.compute-1.amazonaws.com

px.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.162.0.30 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-0-30.compute-1.amazonaws.com

ad.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.29.170 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-29-170.eu-west-1.compute.amazonaws.com

px.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.180 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:280:4::213:7861 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-adaptive-growth.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

conversions-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.226.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edb (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0b::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	code42.com redblue42.code42.com	418 KB
11	6sc.co j.6sc.co — Cisco Umbrella Rank: 5532 c.6sc.co — Cisco Umbrella Rank: 8403 ipv6.6sc.co — Cisco Umbrella Rank: 5709 b.6sc.co — Cisco Umbrella Rank: 3792	22 KB
9	typekit.net use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 566	242 KB
7	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 570 www.google-analytics.com — Cisco Umbrella Rank: 27	39 KB
6	bing.com bat.bing.com — Cisco Umbrella Rank: 376	30 KB
5	doubleclick.net 1 redirects 10192134.fls.doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 79	4 KB
4	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 98	1 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3101	9 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6518	625 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9521	710 B
2	reddit.com conversions-config.reddit.com — Cisco Umbrella Rank: 673835 alb.reddit.com — Cisco Umbrella Rank: 1450	1 KB
2	cloudfunctions.net us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 3163	122 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	69 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	185 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 789	395 B
1	t.co t.co — Cisco Umbrella Rank: 656	377 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 490	703 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 745	15 KB
1	gumgum.com px.gumgum.com — Cisco Umbrella Rank: 15885	183 B
1	ipredictive.com ad.ipredictive.com — Cisco Umbrella Rank: 6031	327 B
1	adentifi.com px.adentifi.com — Cisco Umbrella Rank: 11384	35 B
1	pdst.fm cdn.pdst.fm — Cisco Umbrella Rank: 3122	6 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1335	9 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	136 KB
88	24

	Domain	Requested by
21	redblue42.code42.com	redblue42.code42.com
8	b.6sc.co	redblue42.code42.com
8	use.typekit.net	redblue42.code42.com
6	bat.bing.com	www.googletagmanager.com bat.bing.com redblue42.code42.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	tags.srv.stackadapt.com	redblue42.code42.com tags.srv.stackadapt.com
3	www.google.de	redblue42.code42.com
3	www.google.com	redblue42.code42.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	epsilon.6sense.com	j.6sc.co
2	us-central1-adaptive-growth.cloudfunctions.net	cdn.pdst.fm
2	connect.facebook.net	redblue42.code42.com connect.facebook.net
2	10192134.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	ssl.google-analytics.com	www.googletagmanager.com redblue42.code42.com
1	www.facebook.com	redblue42.code42.com
1	p.typekit.net	redblue42.code42.com
1	adservice.google.com	10192134.fls.doubleclick.net
1	analytics.twitter.com	redblue42.code42.com
1	t.co	redblue42.code42.com
1	alb.reddit.com	redblue42.code42.com
1	conversions-config.reddit.com	www.redditstatic.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	static.ads-twitter.com	redblue42.code42.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	px.gumgum.com	redblue42.code42.com
1	ad.ipredictive.com	redblue42.code42.com
1	px.adentifi.com	redblue42.code42.com
1	cdn.pdst.fm	redblue42.code42.com
1	www.redditstatic.com	www.googletagmanager.com
1	j.6sc.co	redblue42.code42.com
1	www.googletagmanager.com	redblue42.code42.com
88	33

This site contains links to these domains. Also see Links.

Domain
code42.com
www.facebook.com
twitter.com
www.youtube.com
www.code42.com
wordpress.org

Subject Issuer	Validity	Valid
redblue42.code42.com Cloudflare Inc ECC CA-3	`2023-08-05` - `2024-08-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
cdn.pdst.fm GTS CA 1D4	`2024-01-19` - `2024-04-18`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-09-09` - `2024-10-07`	a year	crt.sh
adentifi.com Amazon RSA 2048 M01	`2023-07-06` - `2024-08-03`	a year	crt.sh
*.ipredictive.com Amazon RSA 2048 M02	`2023-03-14` - `2024-04-11`	a year	crt.sh
ie-ad-exch-prd-one-eks.prd.eks.ie.adexchange.gumgum.com Amazon RSA 2048 M01	`2023-07-17` - `2024-08-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-16` - `2024-02-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
misc.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh
*.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Frame ID: 3BD36B473EC9F604E4B6AB9C1077E4B5
Requests: 88 HTTP requests in this frame

Frame: https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F
Frame ID: B313FFF78F98D45FA21DC52084EF2424
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Security Ops and Researcher Blog - Security Ops and Researcher BlogFacebookTwitterGoogleLinkedInYouTube

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

88
Requests

100 %
HTTPS

53 %
IPv6

24
Domains

33
Subdomains

31
IPs

5
Countries

1004 kB
Transfer

2949 kB
Size

57
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://code42.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Code42Software
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/code42
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCVpD7NrBhP9QtnWq_ic36ig
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.code42.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.code42.com/privacy-statement/
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.code42.com/cookie-notice/
Title: Learn more

Search URL Search Domain Scan URL

URL: https://wordpress.org/plugins/gdpr-cookie-compliance/
Title: Powered by GDPR Cookie Compliance

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://10192134.fls.doubleclick.net/activityi;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F HTTP 302
https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F

88 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
redblue42.code42.com/obfuscating-remote-ssh-command-control/ 67 KB
16 KB 529ms
465ms Document
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / WP Engine
Resource Hash: 796f37f967c9cf4e70ce12b9ae5fa55ca60f3173202c1fa30986bc2d2e076e61

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 851a68a089f8913c-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 07 Feb 2024 08:54:32 GMT
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/" <https://redblue42.code42.com/wp-json/wp/v2/posts/8380>; rel="alternate"; type="application/json" <https://redblue42.code42.com/?p=8380>; rel=shortlink
server: cloudflare
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 1
x-cache-group: normal
x-cacheable: SHORT
x-powered-by: WP Engine

GET
H2 200 style.min.css
redblue42.code42.com/wp-includes/css/dist/block-library/ 107 KB
15 KB 469ms
466ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 05 Nov 2023 19:40:32 GMT
server: cloudflare
etag: W/"6547efb0-1add3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37db4913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bundle.css
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/ 386 KB
88 KB 593ms
591ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee990ab4c2f2f268f92a4cb10be71e58162d6d033eb1213055e5c4814045c1cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:11 GMT
server: cloudflare
etag: W/"63a23287-609d0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37db7913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gdpr-main.css
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/ 81 KB
9 KB 473ms
471ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14c77827fd23522626db314fb4127b7aa0bdc6b26059e1b49a9483ee3ccf89c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: W/"6491f7d8-1453e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dbb913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
redblue42.code42.com/wp-includes/js/jquery/ 86 KB
31 KB 495ms
493ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: cloudflare
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dbd913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery-migrate.min.js Show response
redblue42.code42.com/wp-includes/js/jquery/ 13 KB
5 KB 468ms
467ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: cloudflare
etag: W/"6482bd64-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dc0913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bundle.js Show response
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/ 589 KB
154 KB 696ms
695ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07ebc53457e2eb61f40b14b53b18ec28222ed7d0f11ccdd9145e37bde647f85e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:11 GMT
server: cloudflare
etag: W/"63a23287-934e9"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dc2913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 vendor.js Show response
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/ 6 KB
3 KB 484ms
483ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/vendor.js?ver=20171210
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25c419e5b4c69dd558a793817507404ae9f9b40a5f20d018737e205af400c473

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:12 GMT
server: cloudflare
etag: W/"63a23288-197b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dc4913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 main.js Show response
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/scripts/ 60 KB
14 KB 490ms
489ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/scripts/main.js?ver=4.12.3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17c1788bf2f16e188cf73d0038249aec4d32ae8145128b0a27f3c7dc3f9fed74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: W/"6491f7d8-ee4b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 851a68a37dc6913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 404 Code42-blog-bio-logo-96x96.jpg
redblue42.code42.com/wp-content/uploads/2016/11/ 548 B
548 B 528ms
528ms Image
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2016/11/Code42-blog-bio-logo-96x96.jpg
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/html
cf-ray: 851a68a37dc9913c-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 554 KB
136 KB 204ms
181ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

36f2759dcfb61c9a727cc77fc1309461e9791b2099a13040794f25351947d709

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138944
x-xss-protection: 0
last-modified: Wed, 07 Feb 2024 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 07 Feb 2024 08:54:33 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ff92d36b8a48bdd606863262f2c5e68725a0c48346df2c4bfd3f35ea52acd91

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4eb9f6ec0d65558cdb13be19ab0315136ca1d8ab2f1f7a54cc5873702913f60

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 zlu5bge.js Show response
use.typekit.net/ 18 KB
7 KB 249ms
193ms Script
text/javascript 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zlu5bge.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

eeaf3c16ad06374da5c973a0280d21b5655c95ffcee986d6edb9ce7f877ea283

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6827

GET
H3 200 / Show response
redblue42.code42.com/wp-json/react-theme/v1/prettyPermalink//obfuscating-remote-ssh-command-control/ 6 KB
3 KB 583ms
583ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/react-theme/v1/prettyPermalink//obfuscating-remote-ssh-command-control/

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

49d592cada7fbcf6117179df4c762c2a3429711063a0ac828d653644751f9867

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: MISS
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
link: <https://redblue42.code42.com/obfuscating-remote-ssh-command-control/>; rel="alternate"; type=text/html
cf-ray: 851a68a87fc430c6-FRA

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bbf620d916dd02df52101b38cce6ba7d75188addc751307fb9c055bfc93cdab0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 57ms
7ms Script
application/javascript 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Wed, 07 Feb 2024 08:54:33 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 56ms
8ms Script
text/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 07 Feb 2024 07:49:54 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3879
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Wed, 07 Feb 2024 09:49:54 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 59ms
9ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 30 Jan 2024 22:08:33 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "cdb613b732483a878e5e73924ee9a02f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8623

GET
H2

200

activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=syp... Show response
10192134.fls.doubleclick.net/ Frame B313
Redirect Chain

https://10192134.fls.doubleclick.net/activityi;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=...
https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v719...

562 B
770 B

51ms
49ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

e95db5b06852953ed82498d0a900fc0978fa469c5763fe47ce1bf2bcbb7559ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redblue42.code42.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 339
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 07 Feb 2024 08:54:33 GMT
expires: Wed, 07 Feb 2024 08:54:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 07 Feb 2024 08:54:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ping.min.js Show response
cdn.pdst.fm/ 26 KB
6 KB 45ms
8ms Script
application/javascript 35.244.142.80
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pdst.fm/ping.min.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.142.80 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 80.142.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:13:03 GMT
content-encoding: gzip
age: 2490
x-guploader-uploadid: ABPtcPoU4paMtdvj6nIrtFIDkC71ejMCqxNTQX5xXZfjyPcL8zZsNU-wTMYn-Dq3yD2xafTEGqFpRth7Mg
x-goog-storage-class: STANDARD
x-goog-metageneration: 4
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5774
last-modified: Fri, 28 May 2021 20:34:03 GMT
server: UploadServer
etag: "d001d1c9f5a942fa5524eeacb047e819"
vary: Accept-Encoding
x-goog-generation: 1622234043862937
x-goog-hash: crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 5774
accept-ranges: bytes
content-type: application/javascript;
expires: Wed, 07 Feb 2024 09:13:03 GMT

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 18 KB
7 KB 150ms
101ms Script
text/javascript 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: fba37bc3bd46a06dafdb39ba5c4c3c350a78fe4927d75d3dc66ed07667cd5ce1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 07 Feb 2024 08:54:33 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H2 204 Pixels
px.adentifi.com/ 0
35 B 308ms
105ms Image
text/plain 54.91.171.58
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.adentifi.com/Pixels?a_id=9547;p_url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F;product_id=[PRODUCT_ID];uq=2542023909553.437
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.91.171.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-91-171-58.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT

GET
H/1.1 200
OK event
ad.ipredictive.com/d/track/ 0
327 B 401ms
92ms Image
text/plain 54.162.0.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.ipredictive.com/d/track/event?upid=104379&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&cache_buster=[timestamp]&ps=2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.162.0.30 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-162-0-30.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Wed, 07 Feb 2024 08:54:33 GMT
Connection: keep-alive
X-CI-RTID: 564ff28f-42a2-4926-8dc9-8173613a1163
Content-Length: 0

GET
H2 200 conversion
px.gumgum.com/ad/ 0
183 B 114ms
34ms Image
text/plain 52.210.29.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.gumgum.com/ad/conversion?cmp=13103&num=1&rnd=1113916427
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.29.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-29-170.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
timing-allow-origin: *
etag: "0d41d8cd98f00b204e9800998ecf8427e"
content-length: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 44ms
14ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 07 Feb 2024 08:54:33 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: WfU4J1oQzdFJ2i7oa7poA6PfrCUnlqlY69ItRwx6zfcylf/1P8z2YDLXhD7oR5PkTdTsRgL9iVqxCzLXz1mYrw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/979774560/ 3 KB
2 KB 55ms
25ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/979774560/?random=1707296073143&cv=11&fst=1707296073143&bg=ffffff&guid=ON&async=1&gtm=45He4250v71930088za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&hn=www.googleadservices.com&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&pscdl=noapi&auid=818450887.1707296073&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c96505b47ca1b46b55896a7383797ef80fbbca56baad1d0cd8765ab91cdb8e70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1377
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 76ms
35ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 07 Feb 2024 08:54:33 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D821B74DD79B44E8966EFEA92BABA6A6 Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 26ms
8ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-muc13958-MUC

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
703 B 87ms
53ms XHR
application/json 185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
an-x-request-uuid: 8eeb8d0f-9421-4176-b8f7-9edc72583d8f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.197; 80.255.10.197; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
196 B 9ms
8ms XHR
text/html 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-53-42-251.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://redblue42.code42.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
302 B 65ms
13ms XHR
text/html 2a02:26f0:280:4::213:7861
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:4::213:7861 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://redblue42.code42.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:5a::4
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707296073211_34830177_288019587_12_576_10_24_219";dur=1
content-length: 14
expires: Wed, 07 Feb 2024 08:54:33 GMT

POST
H2 200 pdst-events-prod-sink Show response
us-central1-adaptive-growth.cloudfunctions.net/ 2 B
122 B 167ms
166ms Fetch
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by: Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json
Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
server: Google Frontend
access-control-allow-methods: GET, POST
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: d72139c2f6c6e1a19253566103c8dcbc
cache-control: private
function-execution-id: e1qb34ij5dai
access-control-allow-headers: Content-Type, Accept
content-length: 22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame 0
0 171ms
129ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://redblue42.code42.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type, Accept
access-control-allow-methods: GET, POST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 22
content-type: text/html; charset=utf-8
date: Wed, 07 Feb 2024 08:54:33 GMT
function-execution-id: yvafkpi662oa
server: Google Frontend
x-cloud-trace-context: c2df860a5965810e0b5dd39db401b8cc

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 17ms
16ms Image
image/gif 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=480850376&utmhn=redblue42.code42.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&utmhid=2043537456&utmr=-&utmp=%2Fobfuscating-remote-ssh-command-control%2F&utmht=1707296073202&utmac=UA-108467176-2&utmgtm=45He4250n71WVTQKPv71930088za200&utmcc=__utma%3D205608976.388322433.1707296073.1707296073.1707296073.1%3B%2B__utmz%3D205608976.1707296073.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=20190914&utmredir=1&utmu=quAgAABAAAGBAAAAAgAAAAAE~

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 t2_5ns87trnc_telemetry Show response
conversions-config.reddit.com/v1/pixel/config/ 86 B
424 B 48ms
14ms XHR
application/json 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://conversions-config.reddit.com/v1/pixel/config/t2_5ns87trnc_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:32 GMT
nel: {"report_to":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"success_fraction":0.3,"failure_fraction":0.3}
report-to: {"group":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"endpoints":[{"url":"https://w3-reporting-nel.reddit.com/reports"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
content-length: 86
x-served-by: cache-fra-etou8220100-FRA

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 26ms
8ms Image
image/gif 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1707296073209&id=t2_5ns87trnc&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=89187f14-dec0-46cf-9718-7dde0f7cdaba&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_26e8ea0f&dpm=&dpcc=&dprc=
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 adsct
t.co/i/ 43 B
377 B 203ms
180ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=be8b6473-97e0-4269-b08b-b123fd469c14&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6cd46093-a396-44fd-b940-fde54f12aaf0&tw_document_href=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0i7&type=javascript&version=2.3.29

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-response-time: 172
date: Wed, 07 Feb 2024 08:54:32 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 1403dc5bce3f546d
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: e72e5c7cf25cc044b3401e09afda9b78e96b7821ead15768a41751f2a1f5dc6f
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
395 B 204ms
180ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=be8b6473-97e0-4269-b08b-b123fd469c14&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6cd46093-a396-44fd-b940-fde54f12aaf0&tw_document_href=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0i7&type=javascript&version=2.3.29

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-response-time: 172
date: Wed, 07 Feb 2024 08:54:32 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 2ab4c3c098998b97
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 02dcb6e3d3c300ab250ba9cbb5f6b6316aca8bb68d35f02bac57625b072c3042
content-length: 43

GET
H2 200 1385829178350577 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 170ms
169ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1385829178350577?v=2.9.145&r=stable&domain=redblue42.code42.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

72316e492d22dc2af972823146b6e1170931f27994d66c673a032da78cae824b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 07 Feb 2024 08:54:33 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: 6rRbD/CB3cGk6fZ2ZCbz5VqxWVdHvJyHYp8s8YneMwOLuWO2D78+MSlnfks3cFmkkjuiyKrKoaiC4AClNmL6RQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 195ms
190ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A5a%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/979774560/ 42 B
455 B 54ms
21ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/979774560/?random=1707296073143&cv=11&fst=1707292800000&bg=ffffff&guid=ON&async=1&gtm=45He4250v71930088za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_KHji735lpaaWLhEpx9QTP8H8HzJDQw&random=17414829&rmt_tld=0&ipr=y

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/979774560/ 42 B
455 B 54ms
22ms Image
image/gif 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/979774560/?random=1707296073143&cv=11&fst=1707292800000&bg=ffffff&guid=ON&async=1&gtm=45He4250v71930088za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_KHji735lpaaWLhEpx9QTP8H8HzJDQw&random=17414829&rmt_tld=1&ipr=y

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 21000195.js Show response
bat.bing.com/p/action/ 1 KB
839 B 32ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/21000195.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6395856c1f74118c6f845075098035872fa14d8e6275436961e864aae6968a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Wed, 07 Feb 2024 08:54:33 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0128DC6229A144799CF53598515D99C1 Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
286 B 483ms
483ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=21000195&tm=gtm002&Ver=2&mid=d0fbe15c-42e9-4022-9f2e-29bdf94f24cb&sid=833dd800c59611ee9901df985aa72f5a&vid=833e0210c59611ee91ff8da8c9759247&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&p=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&r=&lt=1372&evt=pageLoad&sv=1&rn=784052

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 07 Feb 2024 08:54:33 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D1BA6A1B7D8746A09D4AA945B3F2BA39 Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 191ms
190ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 190ms
189ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%220bec2a4eca6570c7f3f4c5479d608b0e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%228832052cf3a17f48f7a1c2a260db7fd0371cb3eb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 l
use.typekit.net/af/7a16a7/000000000000000077359568/30/ 31 KB
31 KB 45ms
10ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/7a16a7/000000000000000077359568/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n1&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1022542ce1051bbe004c510dafb3b78fbddef5e009d5c1d65bd3583d2de1816b

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "f38232765146dfc7b671501d05dda4b2e87e422b"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 31908

GET
H2 200 l
use.typekit.net/af/e4b1a9/000000000000000077359571/30/ 32 KB
33 KB 55ms
20ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/e4b1a9/000000000000000077359571/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 2ad1a3ce85195c70b579486b5b5b7721a42a5613b35e4a96e68a2d95bced9a3a

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "b10a19accac4d75934ead3e517526b740bdb5a2c"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33156

GET
H2 200 l
use.typekit.net/af/eb4c83/000000000000000077359574/30/ 34 KB
34 KB 48ms
13ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/eb4c83/000000000000000077359574/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i6&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 92fa1843f2d35f8e3162b8c0973fedd4f98b21d92c13af8a6a9ed2aee07b8c2e

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "509cb6be19faece2301894a4515ff0f853591398"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34416

GET
H2 200 l
use.typekit.net/af/d45b9a/000000000000000077359577/30/ 33 KB
33 KB 70ms
35ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d45b9a/000000000000000077359577/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: ccaac2a8b85879c92bbd73e67512e8e8ab0e719ad0163193081ea6abb20031cc

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "f806d2fcac6bea1cced8320378bba8659e3a95e8"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33364

GET
H2 200 l
use.typekit.net/af/6cc429/00000000000000007735957a/30/ 35 KB
35 KB 66ms
31ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/6cc429/00000000000000007735957a/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9c021e60f7e8b7b4ad3672c21529c74f9a1553b36d2131c9b30c73a8aa83ca51

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "e32f2e1468d1ab6c324774fe08a8c96298c1ca86"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 35416

GET
H2 200 l
use.typekit.net/af/56b0cd/00000000000000007735957d/30/ 34 KB
34 KB 57ms
23ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/56b0cd/00000000000000007735957d/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 3be30c09a4c2a44586ae9710ad7c61e5b9e57ba9d24935ad3e6f61aca28b9b06

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "efd2a4eb0e71949802f825497dfc78423b4eaac3"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34328

GET
H2 200 l
use.typekit.net/af/fcae55/000000000000000077359580/30/ 36 KB
36 KB 64ms
29ms Font
application/font-woff2 2a02:26f0:280:6::213:7ad8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/fcae55/000000000000000077359580/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i3&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ad8 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 674b01b85935624f22a298fe520a7caab5052aa1f094c16b9aa2c060227630b0

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
etag: "d2d12fd9ab38ddf939d2f4897e992ad8e28acc1e"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 36476

GET
H2 200 dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=*;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;ua...
adservice.google.com/ddm/fls/z/ Frame B313 42 B
401 B 85ms
47ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=*;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F

Requested by

Host: 10192134.fls.doubleclick.net
URL: https://10192134.fls.doubleclick.net/activityi;dc_pre=CJua4b_tmIQDFUZWHgIdifwO3A;src=10192134;type=lpvq10;cat=mm-al0;ord=8089095154488;npa=0;auiddc=818450887.1707296073;pscdl=noapi;gtm=45He4250v71930088za200;gcd=13l3l3l3l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://10192134.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 99ms
98ms Stylesheet
text/css 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6d2d0d7ed37deadd8ed2a5176e86329363ed9ac31bd34b10cd09a94539705a53

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 07 Feb 2024 08:54:33 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 122ms
98ms Fetch
image/jpeg 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 07 Feb 2024 08:54:33 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 21000195 Show response
bat.bing.com/p/insights/t/ 724 B
895 B 118ms
117ms Script
application/x-javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/t/21000195

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/action/21000195.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0ce11ac9326740a1ea69c5265c924ec0de80344be59cde7ba5e8d5d76a271cc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: -1
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Wed, 07 Feb 2024 08:54:33 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B132A65F9F5F4D5CA181ADC2BCE1D91A Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
vary: Accept-Encoding
x-azure-ref: 20240207T085433Z-ay9zt9p42168re3w7wwe106d700000000bg0000000005mkd
content-type: application/x-javascript
x-cache: CONFIG_NOCACHE
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 614
request-context: appId=cid-v1:238681e8-7d6b-453a-acb6-7dcad74f3111

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
710 B 38ms
20ms XHR
application/json 52.57.226.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.226.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9aebfbc0236ccff41bb8bfe3e7ab44961b66545f59002d1f7712b6e15eb3c2c1

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 8832052cf3a17f48f7a1c2a260db7fd0371cb3eb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
X-6s-CustomID: WebTag1.0 0bec2a4eca6570c7f3f4c5479d608b0e

Response headers

x-trace-id: 4623419749274372570
date: Wed, 07 Feb 2024 08:54:33 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://redblue42.code42.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 38ms
14ms Preflight 52.57.226.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.226.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://redblue42.code42.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://redblue42.code42.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Wed, 07 Feb 2024 08:54:33 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 8001625007853984996

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 63ms
9ms Image
image/gif 2a02:26f0:480:f::213:7edb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=zlu5bge&ht=tk&h=redblue42.code42.com&f=171.173.174.175.176.5474.5475&a=128252755&js=1.21.0&app=typekit&e=js&_=1707296073362
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7edb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
last-modified: Sat, 09 Oct 2021 02:10:03 GMT
server: nginx
etag: "6160f9fb-23"
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 40ms
9ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 07 Feb 2024 07:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3984
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 07 Feb 2024 09:48:09 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 49ms
12ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1385829178350577&ev=PageView&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&rl=&if=false&ts=1707296073434&sw=1600&sh=1200&v=2.9.145&r=stable&ec=0&o=4126&fbp=fb.1.1707296073433.558898096&ler=empty&cdl=API_unavailable&it=1707296073250&coo=false&dpo=LDU&dpoco=1&dpost=1000&exp=e1&rqm=GET

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 07 Feb 2024 08:54:33 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 0.7.20 Show response
bat.bing.com/p/insights/s/ 34 KB
15 KB 44ms
44ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/s/0.7.20

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/insights/t/21000195

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5ab142585097949ade33d1c1c15cf8df7423d78bd45747965c064882e72f83e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Wed, 07 Feb 2024 08:54:33 GMT
x-cache: CONFIG_NOCACHE
x-fd-int-roxy-purgeid: 51562430
content-length: 14592
last-modified: Wed, 24 Jan 2024 14:34:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0CAC50EC2CE94B99979EDD3FF998AE99 Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
etag: W/"0x8DC1CE988AFCDA8"
vary: Accept-Encoding
x-azure-ref: 20240207T085433Z-ph3drv37655mfck4dsf84huwh40000000de00000000024bv
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 55d17369-d01e-007a-07ca-52339b000000
cache-control: public, max-age=86400
x-ms-version: 2018-03-28

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
335 B 113ms
112ms XHR
text/plain 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=Qj_LCZmHF4CpXTmVPFE52w&is_js=true&landing_url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&t=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&tip=uyu8Tyc6O8Dff9PocMB0oq0jX7emPE5CzmWIaXaIS5k&host=https%3A%2F%2Fredblue42.code42.com&sa_conv_data_css_value=%270-71dd7de1-86fc-502e-723f-073507e3e411%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd971dd7de186fc502e723f073507e3e41150ff0ac5&sa-user-id-v3=s%253AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDJio2uBjABOgQXuSKpQgRR4ETa.06KD8O%252FlBqdSNon3YW0HnZgHEV6LphK%252BHSy%252FM8kIt98&sa-user-id-v2=s%253Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM&sa-user-id=s%253A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%252Fs92iJd5EElxltBKT0Di%252FDkySJ%252Bs
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 63b0425d066209894571135b8fbc4671c7dc015f3a4ca057436fe915b757aaee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: https://redblue42.code42.com
date: Wed, 07 Feb 2024 08:54:33 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 16ms
15ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2043537456&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_utma=205608976.388322433.1707296073.1707296073.1707296073.1&_utmz=205608976.1707296073.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707296073478&_u=YQBCAAABAAAAAC~&jid=1678442893&gjid=1611298574&cid=388322433.1707296073&tid=UA-775547-16&_gid=224218038.1707296073&_r=1&_slc=1&gtm=45He4250n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1659038316

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
352 B 60ms
19ms XHR
text/plain 2a00:1450:400c:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=1678442893&gjid=1611298574&_gid=224218038.1707296073&_u=YQBCAAAAAAAAAC~&z=2113401587

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 35ms
34ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=1678442893&_u=YQBCAAAAAAAAAC~&z=1274725547

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 35ms
34ms Image
image/gif 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=1678442893&_u=YQBCAAAAAAAAAC~&z=1274725547

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 n Show response
bat.bing.com/p/insights/c/ 0
213 B 113ms
112ms XHR
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/n

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/insights/s/0.7.20

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/x-webinsights-gzip
Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Wed, 07 Feb 2024 08:54:33 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CD230AF3E75345A082273CD7A29E7BEE Ref B: FRA31EDGE0619 Ref C: 2024-02-07T08:54:33Z
vary: Origin
x-cache: CONFIG_NOCACHE
access-control-allow-origin: https://redblue42.code42.com
access-control-allow-credentials: true
request-context: appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2

GET
H3 200 posts Show response
redblue42.code42.com/wp-json/wp/v2/ 13 KB
5 KB 184ms
184ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/posts?categories=4863&exclude[]=8380&per_page=2

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

e0a25ec1d20e06a528e824efeb1ac19ed7e1f4b5b8dfbdf9790c7e85ce1df4df

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: MISS
alt-svc: h3=":443"; ma=86400
server: cloudflare
x-wp-totalpages: 14
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-wp-total: 28
x-robots-tag: noindex
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
link: <https://redblue42.code42.com/wp-json/wp/v2/posts?categories%5B0%5D=4863&exclude%5B0%5D=8380&per_page=2&page=2>; rel="next"
cf-ray: 851a68ac2c4c30c6-FRA

GET
H3 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
722 B 9ms
8ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:04:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2975
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 07 Feb 2024 09:04:58 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 23ms
19ms XHR
text/plain 2a00:1450:400c:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=200364392&gjid=1660710949&_gid=224218038.1707296073&_u=aSDCgEAjAAAAAGAAI~&z=1772385792

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 10ms
8ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=2043537456&t=pageview&_s=1&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=205608976.388322433.1707296073.1707296073.1707296073.1&_utmz=205608976.1707296073.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707296073800&_u=aSDCgEAjAAAAACAAI~&jid=200364392&gjid=1660710949&cid=388322433.1707296073&tid=UA-775547-16&_gid=224218038.1707296073&gtm=45He4250n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&cd8=&z=2017479522

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 13:29:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69907
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 heroiccondweb-bold.woff
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme//assets/fonts/ 24 KB
24 KB 23ms
22ms Font
font/woff 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme//assets/fonts/heroiccondweb-bold.woff
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e287d9b33034349168f1dde3d59659330cadd29d98d68236853f3a21fa21386

Request headers

Referer: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
cf-cache-status: HIT
last-modified: Tue, 20 Dec 2022 22:09:12 GMT
server: cloudflare
age: 141919
etag: "63a23288-5f5c"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 851a68ad8e3830c6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 24412

GET
H3 200 142 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
873 B 463ms
462ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/142

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 1
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 851a68adae5a30c6-FRA

GET
H3 200 142 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
873 B 132ms
131ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/142

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:33 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 2
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 851a68adae5e30c6-FRA

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba496cd9446a1746e36b3f6910291a52350db7cddedebabfc7df3afb47e7a9bd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 159 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
858 B 463ms
463ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/159

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 1
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 851a68adae5f30c6-FRA

GET
H3 200 159 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
858 B 462ms
461ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/159

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 2
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 851a68adae6030c6-FRA

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 32ms
31ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=200364392&_u=aSDCgEAjAAAAAGAAI~&z=1083748247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 33ms
32ms Image
image/gif 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=388322433.1707296073&jid=200364392&_u=aSDCgEAjAAAAAGAAI~&z=1083748247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Feb 2024 08:54:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=2043537456&t=timing&_s=2&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2056&pdt=2&dns=0&rrt=0&srt=465&tcp=22&dit=1372&clt=1372&_gst=1717&_gbt=1767&_utma=205608976.388322433.1707296073.1707296073.1707296073.1&_utmz=205608976.1707296073.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707296073873&_u=aSDCgEAjAAAAAGAAI~&jid=&gjid=&cid=388322433.1707296073&tid=UA-775547-16&_gid=224218038.1707296073&gtm=45He4250n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&cd8=&z=70409606

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Feb 2024 13:29:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69907
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 T552RDEDB-ULHCM4PEC-cce960a31ad8-512-1-150x150.jpg
redblue42.code42.com/wp-content/uploads/2019/12/ 3 KB
3 KB 483ms
482ms Image
image/jpeg 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2019/12/T552RDEDB-ULHCM4PEC-cce960a31ad8-512-1-150x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6188cf8cdc4ace1742d1df11d97d709e074046e56060edb33b77eaba1ef72272

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
cf-cache-status: MISS
last-modified: Tue, 10 Dec 2019 20:46:12 GMT
server: cloudflare
etag: "5df00414-c9d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 851a68ae7f5630c6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 3229

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 206ms
205ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A33%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 laura-150x150.jpg
redblue42.code42.com/wp-content/uploads/2021/12/ 8 KB
8 KB 467ms
466ms Image
image/jpeg 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2021/12/laura-150x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 750570e0f92396e778a9bd7e76b404fdb29be65199d30e1e2701b75438b7bc6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:34 GMT
cf-cache-status: MISS
last-modified: Thu, 09 Dec 2021 21:08:44 GMT
server: cloudflare
etag: "61b2705c-213d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 851a68b09ab130c6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 8509

GET
H3 200 nunito-v8-latin-700.woff2
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/ 18 KB
19 KB 23ms
23ms Font
font/woff2 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/nunito-v8-latin-700.woff2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc28355b0b7217392395460dd7dfbc65a4cf0822c986a7533f4ca7434799e53

Request headers

Referer: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:35 GMT
cf-cache-status: HIT
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
age: 124669
etag: "6491f7d8-49e0"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 851a68b54a1030c6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 18912

GET
H3 200 nunito-v8-latin-regular.woff2
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/ 18 KB
19 KB 29ms
29ms Font
font/woff2 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/nunito-v8-latin-regular.woff2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 623b62596e07df1fbf3a9fc0219c238e373bec6e55349826b0315b50ed2a7a7d

Request headers

Referer: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:35 GMT
cf-cache-status: HIT
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
age: 124669
etag: "6491f7d8-496c"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 851a68b54a1730c6-FRA
alt-svc: h3=":443"; ma=86400
content-length: 18796

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 189ms
189ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:35 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 191ms
191ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A35%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:36 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 197ms
196ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A36%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:37 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 191ms
190ms Image
image/gif 23.53.42.251
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=0f8f5a02-60d7-462e-86cd-30539816680d&session=3dd54226-21c7-4680-8384-8e952b48bdbd&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2007%20Feb%202024%2008%3A54%3A37%20GMT%22%2C%22timeSpent%22%3A%221021%22%2C%22totalTimeSpent%22%3A%225026%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=d6cafed2-fb77-4432-8e6b-d6cdec300851&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.53.42.251 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-53-42-251.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 08:54:38 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

57 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-21 03:50:56	Name: __utma Value: 205608976.388322433.1707296073.1707296073.1707296073.1
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1969-12-31 23:59:59	Name: __utmc Value: 205608976
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 22:37:44	Name: __utmz Value: 205608976.1707296073.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 18:14:56	Name: __utmt_UA-108467176-2 Value: 1
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 18:14:57	Name: __utmb Value: 205608976.1.10.1707296073
.redblue42.code42.com/	1970-01-20 18:14:57	Name: __cf_bm Value: UFBlU3lM8GhoM5flSZ4o0TVDLPRHaJiJxGRprDhu1.g-1707296072-1-Ac5+RSTIy0q5XX9Br3mWN0zHri5qP5jHGkdaEjy6V3+koRnNtbZXgYFNi2j7r/HGq97zbnnMuRj2y/8rMFBgORA=
.code42.com/	1970-01-20 20:24:32	Name: _gcl_au Value: 1.1.818450887.1707296073
redblue42.code42.com/	1970-01-21 03:00:32	Name: __pdst Value: 5fc110fafc5942e4b2c5b339fb43a744
.code42.com/	1970-01-20 20:24:32	Name: _rdt_uuid Value: 1707296073208.89187f14-dec0-46cf-9718-7dde0f7cdaba
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_source Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_medium Value: (none)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_campaign Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_content Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_term Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_adgroup Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: last_asset_accessed Value: Obfuscating Remote SSH Command & Control – Security Ops and Researcher Blog
redblue42.code42.com/	1969-12-31 23:59:59	Name: last_asset_accessed_url Value: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_business_unit Value: ent
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_campaign_name Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_channel Value: Direct
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_campaign Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_source Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_medium Value: (none)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_term Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_content Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_creation Value: 1
.gumgum.com/	1970-01-21 03:00:32	Name: cs Value: true
redblue42.code42.com/	1970-01-21 03:50:56	Name: _gd_visitor Value: 0f8f5a02-60d7-462e-86cd-30539816680d
redblue42.code42.com/	1970-01-20 18:15:10	Name: _gd_session Value: 3dd54226-21c7-4680-8384-8e952b48bdbd
.adnxs.com/	1970-01-21 03:50:56	Name: receive-cookie-deprecation Value: 1
redblue42.code42.com/	1970-01-20 18:25:00	Name: _an_uid Value: 0
.doubleclick.net/	1970-01-21 03:36:32	Name: IDE Value: AHWqTUlzekyZWt9h153qicmDYCY7GBdM2ppHDAnGl-7SU-xYV1O56w678TtWdd8vRxE
.doubleclick.net/	1970-01-20 22:34:08	Name: receive-cookie-deprecation Value: 1
tags.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id Value: s%3A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%2Fs92iJd5EElxltBKT0Di%2FDkySJ%2Bs
.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id Value: s%3A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%2Fs92iJd5EElxltBKT0Di%2FDkySJ%2Bs
tags.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id-v2 Value: s%3Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id-v2 Value: s%3Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
tags.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id-v3 Value: s%3AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDJio2uBjABOgQXuSKpQgRR4ETa.06KD8O%2FlBqdSNon3YW0HnZgHEV6LphK%2BHSy%2FM8kIt98
.srv.stackadapt.com/	1970-01-21 03:00:32	Name: sa-user-id-v3 Value: s%3AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDJio2uBjABOgQXuSKpQgRR4ETa.06KD8O%2FlBqdSNon3YW0HnZgHEV6LphK%2BHSy%2FM8kIt98
redblue42.code42.com/	1970-01-21 03:00:32	Name: sa-user-id Value: s%253A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%252Fs92iJd5EElxltBKT0Di%252FDkySJ%252Bs
redblue42.code42.com/	1970-01-21 03:00:32	Name: sa-user-id-v2 Value: s%253Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
redblue42.code42.com/	1970-01-21 03:00:32	Name: sa-user-id-v3 Value: s%253AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDJio2uBjABOgQXuSKpQgRR4ETa.06KD8O%252FlBqdSNon3YW0HnZgHEV6LphK%252BHSy%252FM8kIt98
.t.co/	1970-01-21 03:50:56	Name: muc_ads Value: dbf97346-fb22-49fa-9f05-24106c0267fe
.twitter.com/	1970-01-21 03:50:56	Name: personalization_id Value: "v1_9xfOlq+7YnwNe5U1LaVJXA=="
.code42.com/	1970-01-20 20:24:32	Name: _fbp Value: fb.1.1707296073433.558898096
.6sc.co/	1970-01-21 03:50:56	Name: 6suuid Value: f72a3517ec6a01004945c365ce010000b2266700
.redblue42.code42.com/	1970-01-21 03:50:56	Name: _ga Value: GA1.3.388322433.1707296073
.redblue42.code42.com/	1970-01-20 18:16:22	Name: _gid Value: GA1.3.224218038.1707296073
.redblue42.code42.com/	1970-01-20 18:14:56	Name: _gat_UA-775547-16 Value: 1
.code42.com/	1970-01-20 18:16:22	Name: _uetsid Value: 833dd800c59611ee9901df985aa72f5a\|1ewel09\|2\|fj2\|0\|1498
.ipredictive.com/	1970-01-21 03:00:32	Name: cu Value: e17204a5-a207-4680-a0ed-8ec93f9f48d8\|1707296073491
.code42.com/	1970-01-21 03:36:32	Name: _uetvid Value: 833e0210c59611ee91ff8da8c9759247\|fgiwwj\|1707296073709\|1\|1\|bat.bing.com/p/insights/c/n
.bing.com/	1970-01-21 03:36:32	Name: MUID Value: 11BE12F52AB06DBC2B8006EB2B3B6CAC
.code42.com/	1970-01-21 03:50:56	Name: _ga Value: GA1.2.388322433.1707296073
.code42.com/	1970-01-20 18:16:22	Name: _gid Value: GA1.2.224218038.1707296073
.redblue42.code42.com/	1970-01-21 03:00:32	Name: internalTraffic Value: false
.code42.com/	1970-01-20 18:14:56	Name: _dc_gtm_UA-775547-16 Value: 1

46 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://redblue42.code42.com/wp-content/uploads/2016/11/Code42-blog-bio-logo-96x96.jpg Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1385829178350577?v=2.9.145&r=stable&domain=redblue42.code42.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10192134.fls.doubleclick.net
ad.ipredictive.com
adservice.google.com
alb.reddit.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.pdst.fm
connect.facebook.net
conversions-config.reddit.com
epsilon.6sense.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
p.typekit.net
px.adentifi.com
px.gumgum.com
redblue42.code42.com
secure.adnxs.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
us-central1-adaptive-growth.cloudfunctions.net
use.typekit.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.redditstatic.com
104.244.42.5
104.244.42.67
141.193.213.10
142.250.185.198
151.101.1.140
185.89.210.180
199.232.188.157
2001:4860:4802:36::36
23.53.42.251
2620:1ec:c11::200
2a00:1450:4001:80f::2008
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:829::2008
2a00:1450:4001:829::200e
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c0b::9d
2a02:26f0:280:4::213:7861
2a02:26f0:280:6::213:7ad8
2a02:26f0:480:f::213:7edb
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:600::396
3.77.28.166
35.244.142.80
52.210.29.170
52.57.226.31
54.162.0.30
54.91.171.58
07ebc53457e2eb61f40b14b53b18ec28222ed7d0f11ccdd9145e37bde647f85e
0ce11ac9326740a1ea69c5265c924ec0de80344be59cde7ba5e8d5d76a271cc8
1022542ce1051bbe004c510dafb3b78fbddef5e009d5c1d65bd3583d2de1816b
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
14c77827fd23522626db314fb4127b7aa0bdc6b26059e1b49a9483ee3ccf89c3
17c1788bf2f16e188cf73d0038249aec4d32ae8145128b0a27f3c7dc3f9fed74
25c419e5b4c69dd558a793817507404ae9f9b40a5f20d018737e205af400c473
2ad1a3ce85195c70b579486b5b5b7721a42a5613b35e4a96e68a2d95bced9a3a
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
36f2759dcfb61c9a727cc77fc1309461e9791b2099a13040794f25351947d709
3be30c09a4c2a44586ae9710ad7c61e5b9e57ba9d24935ad3e6f61aca28b9b06
49d592cada7fbcf6117179df4c762c2a3429711063a0ac828d653644751f9867
4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5ab142585097949ade33d1c1c15cf8df7423d78bd45747965c064882e72f83e6
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
6188cf8cdc4ace1742d1df11d97d709e074046e56060edb33b77eaba1ef72272
623b62596e07df1fbf3a9fc0219c238e373bec6e55349826b0315b50ed2a7a7d
6395856c1f74118c6f845075098035872fa14d8e6275436961e864aae6968a98
63b0425d066209894571135b8fbc4671c7dc015f3a4ca057436fe915b757aaee
674b01b85935624f22a298fe520a7caab5052aa1f094c16b9aa2c060227630b0
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6d2d0d7ed37deadd8ed2a5176e86329363ed9ac31bd34b10cd09a94539705a53
72316e492d22dc2af972823146b6e1170931f27994d66c673a032da78cae824b
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
750570e0f92396e778a9bd7e76b404fdb29be65199d30e1e2701b75438b7bc6b
796f37f967c9cf4e70ce12b9ae5fa55ca60f3173202c1fa30986bc2d2e076e61
7e287d9b33034349168f1dde3d59659330cadd29d98d68236853f3a21fa21386
7ff92d36b8a48bdd606863262f2c5e68725a0c48346df2c4bfd3f35ea52acd91
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
92fa1843f2d35f8e3162b8c0973fedd4f98b21d92c13af8a6a9ed2aee07b8c2e
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9aebfbc0236ccff41bb8bfe3e7ab44961b66545f59002d1f7712b6e15eb3c2c1
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9c021e60f7e8b7b4ad3672c21529c74f9a1553b36d2131c9b30c73a8aa83ca51
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
ba496cd9446a1746e36b3f6910291a52350db7cddedebabfc7df3afb47e7a9bd
bbf620d916dd02df52101b38cce6ba7d75188addc751307fb9c055bfc93cdab0
bca51ed2fe251488a1b150edf560d43880f1486740f34d24120ede486f99676b
c4eb9f6ec0d65558cdb13be19ab0315136ca1d8ab2f1f7a54cc5873702913f60
c96505b47ca1b46b55896a7383797ef80fbbca56baad1d0cd8765ab91cdb8e70
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
ccaac2a8b85879c92bbd73e67512e8e8ab0e719ad0163193081ea6abb20031cc
cdc28355b0b7217392395460dd7dfbc65a4cf0822c986a7533f4ca7434799e53
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a
e0a25ec1d20e06a528e824efeb1ac19ed7e1f4b5b8dfbdf9790c7e85ce1df4df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e95db5b06852953ed82498d0a900fc0978fa469c5763fe47ce1bf2bcbb7559ef
ee990ab4c2f2f268f92a4cb10be71e58162d6d033eb1213055e5c4814045c1cd
eeaf3c16ad06374da5c973a0280d21b5655c95ffcee986d6edb9ce7f877ea283
eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fba37bc3bd46a06dafdb39ba5c4c3c350a78fe4927d75d3dc66ed07667cd5ce1
fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

redblue42.code42.com Open in urlscan Pro 141.193.213.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

88 Requests

100 %HTTPS

53 %IPv6

24 Domains

33 Subdomains

31 IPs

5 Countries

1004 kBTransfer

2949 kBSize

57 Cookies

8 Outgoing links

Redirected requests

88 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

redblue42.code42.com Open in urlscan Pro
141.193.213.10 Public Scan

Screenshot
Live screenshot

Full Image

88
Requests

100 %
HTTPS

53 %
IPv6

24
Domains

33
Subdomains

31
IPs

5
Countries

1004 kB
Transfer

2949 kB
Size

57
Cookies

88 HTTP transactions
4 data transactions