redblue42.code42.com Open in urlscan Pro
141.193.213.10 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Submission: On February 04 via api (February 4th 2024, 1:54:24 am UTC) from US — Scanned from DE

Summary HTTP 88 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 32 IPs in 4 countries across 24 domains to perform 88 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is redblue42.code42.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 5th 2023. Valid for: a year.

This is the only time redblue42.code42.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
21	141.193.213.10 141.193.213.10	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:400... 2a04:4e42:400::396	54113 (FASTLY) (FASTLY)
1 2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1	35.244.142.80 35.244.142.80	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	35.156.130.186 35.156.130.186	16509 (AMAZON-02) (AMAZON-02)
1	18.214.166.242 18.214.166.242	14618 (AMAZON-AES) (AMAZON-AES)
1	52.73.1.39 52.73.1.39	14618 (AMAZON-AES) (AMAZON-AES)
1	52.210.29.170 52.210.29.170	16509 (AMAZON-02) (AMAZON-02)
8	2a02:26f0:480... 2a02:26f0:480:f::213:7ec6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
6	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	146.75.116.157 146.75.116.157	54113 (FASTLY) (FASTLY)
10	104.115.82.10 104.115.82.10	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
2	2001:4860:480... 2001:4860:4802:36::36	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	185.89.211.116 185.89.211.116	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:480... 2a02:26f0:480:23::1726:629c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:280... 2a02:26f0:280:6::213:7ac7	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.57.226.31 52.57.226.31	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
5	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c07::9a	15169 (GOOGLE) (GOOGLE)
88	32

21 141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

redblue42.code42.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

10192134.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.142.80 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 80.142.244.35.bc.googleusercontent.com

cdn.pdst.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.156.130.186 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-130-186.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.214.166.242 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-214-166-242.compute-1.amazonaws.com

px.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.73.1.39 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-1-39.compute-1.amazonaws.com

ad.ipredictive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.29.170 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-29-170.eu-west-1.compute.amazonaws.com

px.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.115.82.10 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-115-82-10.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (United States)

ASN54113 (FASTLY, US)

conversions-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::36 (United States)

ASN15169 (GOOGLE, US)

us-central1-adaptive-growth.cloudfunctions.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.211.116 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:23::1726:629c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:280:6::213:7ac7 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.226.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c07::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	code42.com redblue42.code42.com	418 KB
11	6sc.co j.6sc.co — Cisco Umbrella Rank: 5532 c.6sc.co — Cisco Umbrella Rank: 8403 ipv6.6sc.co — Cisco Umbrella Rank: 5709 b.6sc.co — Cisco Umbrella Rank: 3792	22 KB
9	typekit.net use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 566	242 KB
7	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 570 www.google-analytics.com — Cisco Umbrella Rank: 27	39 KB
6	bing.com bat.bing.com — Cisco Umbrella Rank: 376	30 KB
5	doubleclick.net 1 redirects 10192134.fls.doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 79	4 KB
4	google.com www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 98	1 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3101	9 KB
3	google.de www.google.de — Cisco Umbrella Rank: 6518	669 B
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9521	674 B
2	cloudfunctions.net us-central1-adaptive-growth.cloudfunctions.net — Cisco Umbrella Rank: 3163	122 B
2	reddit.com conversions-config.reddit.com — Cisco Umbrella Rank: 673835 alb.reddit.com — Cisco Umbrella Rank: 1450	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	69 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	185 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 490	703 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 789	396 B
1	t.co t.co — Cisco Umbrella Rank: 656	377 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 745	15 KB
1	gumgum.com px.gumgum.com — Cisco Umbrella Rank: 15885	182 B
1	ipredictive.com ad.ipredictive.com — Cisco Umbrella Rank: 6031	327 B
1	adentifi.com px.adentifi.com — Cisco Umbrella Rank: 11384	35 B
1	pdst.fm cdn.pdst.fm — Cisco Umbrella Rank: 3122	6 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1335	9 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	135 KB
88	24

	Domain	Requested by
21	redblue42.code42.com	redblue42.code42.com
8	b.6sc.co	redblue42.code42.com
8	use.typekit.net	redblue42.code42.com
6	bat.bing.com	www.googletagmanager.com bat.bing.com redblue42.code42.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	tags.srv.stackadapt.com	redblue42.code42.com tags.srv.stackadapt.com
3	www.google.de	redblue42.code42.com
3	www.google.com	redblue42.code42.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	epsilon.6sense.com	j.6sc.co
2	us-central1-adaptive-growth.cloudfunctions.net	cdn.pdst.fm
2	connect.facebook.net	redblue42.code42.com connect.facebook.net
2	10192134.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	ssl.google-analytics.com	www.googletagmanager.com redblue42.code42.com
1	www.facebook.com	redblue42.code42.com
1	p.typekit.net	redblue42.code42.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	adservice.google.com	10192134.fls.doubleclick.net
1	analytics.twitter.com	redblue42.code42.com
1	t.co	redblue42.code42.com
1	alb.reddit.com	redblue42.code42.com
1	conversions-config.reddit.com	www.redditstatic.com
1	j.6sc.co	redblue42.code42.com
1	static.ads-twitter.com	redblue42.code42.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	px.gumgum.com	redblue42.code42.com
1	ad.ipredictive.com	redblue42.code42.com
1	px.adentifi.com	redblue42.code42.com
1	cdn.pdst.fm	redblue42.code42.com
1	www.redditstatic.com	www.googletagmanager.com
1	www.googletagmanager.com	redblue42.code42.com
88	33

This site contains links to these domains. Also see Links.

Domain
code42.com
www.facebook.com
twitter.com
www.youtube.com
www.code42.com
wordpress.org

Subject Issuer	Validity	Valid
redblue42.code42.com Cloudflare Inc ECC CA-3	`2023-08-05` - `2024-08-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
cdn.pdst.fm GTS CA 1D4	`2024-01-19` - `2024-04-18`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-09-09` - `2024-10-07`	a year	crt.sh
adentifi.com Amazon RSA 2048 M01	`2023-07-06` - `2024-08-03`	a year	crt.sh
*.ipredictive.com Amazon RSA 2048 M02	`2023-03-14` - `2024-04-11`	a year	crt.sh
ie-ad-exch-prd-one-eks.prd.eks.ie.adexchange.gumgum.com Amazon RSA 2048 M01	`2023-07-17` - `2024-08-14`	a year	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-13` - `2024-02-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
misc.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-31` - `2024-10-29`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M01	`2023-05-01` - `2024-05-29`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Frame ID: 7866686420302D5AE452DC42CB237AAA
Requests: 88 HTTP requests in this frame

Frame: https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F
Frame ID: 3D4D7ECE28F3922544BD67C6FD97860D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Security Ops and Researcher Blog - Security Ops and Researcher BlogFacebookTwitterGoogleLinkedInYouTube

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

88
Requests

100 %
HTTPS

52 %
IPv6

24
Domains

33
Subdomains

32
IPs

4
Countries

1003 kB
Transfer

2946 kB
Size

58
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://code42.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Code42Software
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/code42
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCVpD7NrBhP9QtnWq_ic36ig
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.code42.com/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.code42.com/privacy-statement/
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.code42.com/cookie-notice/
Title: Learn more

Search URL Search Domain Scan URL

URL: https://wordpress.org/plugins/gdpr-cookie-compliance/
Title: Powered by GDPR Cookie Compliance

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14

https://10192134.fls.doubleclick.net/activityi;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F HTTP 302
https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F

88 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
redblue42.code42.com/obfuscating-remote-ssh-command-control/ 67 KB
16 KB 533ms
481ms Document
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / WP Engine
Resource Hash: 36649911dda94e1f560545e87e5b36d0ce3562af26f507846e73f0d93e58242a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=600, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 84ff48eddec065cc-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 04 Feb 2024 01:54:18 GMT
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/" <https://redblue42.code42.com/wp-json/wp/v2/posts/8380>; rel="alternate"; type="application/json" <https://redblue42.code42.com/?p=8380>; rel=shortlink
server: cloudflare
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 1
x-cache-group: normal
x-cacheable: SHORT
x-powered-by: WP Engine

GET
H2 200 style.min.css
redblue42.code42.com/wp-includes/css/dist/block-library/ 107 KB
14 KB 478ms
476ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 05 Nov 2023 19:40:32 GMT
server: cloudflare
etag: W/"6547efb0-1add3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82565cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bundle.css
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/ 386 KB
88 KB 607ms
606ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ee990ab4c2f2f268f92a4cb10be71e58162d6d033eb1213055e5c4814045c1cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:11 GMT
server: cloudflare
etag: W/"63a23287-609d0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82665cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gdpr-main.css
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/ 81 KB
9 KB 509ms
508ms Stylesheet
text/css 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14c77827fd23522626db314fb4127b7aa0bdc6b26059e1b49a9483ee3ccf89c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: W/"6491f7d8-1453e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82765cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
redblue42.code42.com/wp-includes/js/jquery/ 86 KB
31 KB 479ms
478ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: cloudflare
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82865cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery-migrate.min.js Show response
redblue42.code42.com/wp-includes/js/jquery/ 13 KB
5 KB 488ms
487ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: cloudflare
etag: W/"6482bd64-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82965cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bundle.js Show response
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/ 589 KB
154 KB 730ms
729ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07ebc53457e2eb61f40b14b53b18ec28222ed7d0f11ccdd9145e37bde647f85e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:11 GMT
server: cloudflare
etag: W/"63a23287-934e9"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82a65cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 vendor.js Show response
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/ 6 KB
3 KB 472ms
472ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/vendor.js?ver=20171210
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25c419e5b4c69dd558a793817507404ae9f9b40a5f20d018737e205af400c473

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:12 GMT
server: cloudflare
etag: W/"63a23288-197b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82b65cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 main.js Show response
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/scripts/ 60 KB
14 KB 490ms
489ms Script
application/javascript 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/scripts/main.js?ver=4.12.3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 17c1788bf2f16e188cf73d0038249aec4d32ae8145128b0a27f3c7dc3f9fed74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: W/"6491f7d8-ee4b"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84ff48f0e82c65cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 404 Code42-blog-bio-logo-96x96.jpg
redblue42.code42.com/wp-content/uploads/2016/11/ 548 B
548 B 513ms
512ms Image
text/html 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2016/11/Code42-blog-bio-logo-96x96.jpg
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:18 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/html
cf-ray: 84ff48f0e82d65cc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 551 KB
135 KB 88ms
66ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f8a01afc25491b290978ac6fdb80b200a81c08029ca1389a14e00357294d51fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137975
x-xss-protection: 0
last-modified: Sun, 04 Feb 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 04 Feb 2024 01:54:19 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ff92d36b8a48bdd606863262f2c5e68725a0c48346df2c4bfd3f35ea52acd91

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4eb9f6ec0d65558cdb13be19ab0315136ca1d8ab2f1f7a54cc5873702913f60

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 48ms
7ms Script
text/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 04 Feb 2024 01:49:54 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 265
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Sun, 04 Feb 2024 03:49:54 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 23ms
7ms Script
application/javascript 2a04:4e42:400::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 30 Jan 2024 22:08:33 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "cdb613b732483a878e5e73924ee9a02f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8623

GET
H2

200

activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypha... Show response
10192134.fls.doubleclick.net/ Frame 3D4D
Redirect Chain

https://10192134.fls.doubleclick.net/activityi;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sy...
https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930...

561 B
639 B

44ms
43ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

c68250e72b79404e412f4c56f79f73430f1d1a840d2aa802793ed2f60d26cfc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://redblue42.code42.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 334
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 04 Feb 2024 01:54:19 GMT
expires: Sun, 04 Feb 2024 01:54:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 04 Feb 2024 01:54:19 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ping.min.js Show response
cdn.pdst.fm/ 26 KB
6 KB 38ms
7ms Script
application/javascript 35.244.142.80
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pdst.fm/ping.min.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.142.80 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 80.142.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:38:06 GMT
content-encoding: gzip
age: 973
x-guploader-uploadid: ABPtcPrEJ7nEZ618acaAeHtt-0z0SM3q7KvLqG5BWUpcjxPIoEtckL27qbbiIcVCy6zkFaULTxZ2aaTXQQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 4
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5774
last-modified: Fri, 28 May 2021 20:34:03 GMT
server: UploadServer
etag: "d001d1c9f5a942fa5524eeacb047e819"
vary: Accept-Encoding
x-goog-generation: 1622234043862937
x-goog-hash: crc32c=oKoi/w==, md5=0AHRyfWpQvpVJO6ssEfoGQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 5774
accept-ranges: bytes
content-type: application/javascript;
expires: Sun, 04 Feb 2024 02:38:06 GMT

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 18 KB
7 KB 130ms
98ms Script
text/javascript 35.156.130.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.156.130.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-130-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: f7c8c0bbc379cec12f50ead8f01a51b802dda7973d2473513557e85b5613bbba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 04 Feb 2024 01:54:19 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H2 204 Pixels
px.adentifi.com/ 0
35 B 281ms
90ms Image
text/plain 18.214.166.242
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.adentifi.com/Pixels?a_id=9547;p_url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F;product_id=[PRODUCT_ID];uq=8114397337024.532
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.214.166.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-166-242.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT

GET
H/1.1 200
OK event
ad.ipredictive.com/d/track/ 0
327 B 382ms
91ms Image
text/plain 52.73.1.39
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.ipredictive.com/d/track/event?upid=104379&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&cache_buster=[timestamp]&ps=2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.1.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-1-39.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Sun, 04 Feb 2024 01:54:19 GMT
Connection: keep-alive
X-CI-RTID: ea9242b8-5d73-4b7e-8e92-b17559de7bb4
Content-Length: 0

GET
H2 200 conversion
px.gumgum.com/ad/ 0
182 B 95ms
32ms Image
text/plain 52.210.29.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.gumgum.com/ad/conversion?cmp=13103&num=1&rnd=567687567
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.29.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-29-170.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
timing-allow-origin: *
etag: "0d41d8cd98f00b204e9800998ecf8427e"
content-length: 0

GET
H2 200 zlu5bge.js Show response
use.typekit.net/ 18 KB
7 KB 216ms
149ms Script
text/javascript 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zlu5bge.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

eeaf3c16ad06374da5c973a0280d21b5655c95ffcee986d6edb9ce7f877ea283

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6827

GET
H3 200 / Show response
redblue42.code42.com/wp-json/react-theme/v1/prettyPermalink//obfuscating-remote-ssh-command-control/ 6 KB
3 KB 509ms
508ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/react-theme/v1/prettyPermalink//obfuscating-remote-ssh-command-control/

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

49d592cada7fbcf6117179df4c762c2a3429711063a0ac828d653644751f9867

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: MISS
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
link: <https://redblue42.code42.com/obfuscating-remote-ssh-command-control/>; rel="alternate"; type=text/html
cf-ray: 84ff48f63fb56916-FRA

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bbf620d916dd02df52101b38cce6ba7d75188addc751307fb9c055bfc93cdab0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
197 B 15ms
14ms Image
image/gif 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2063739988&utmhn=redblue42.code42.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&utmhid=1192520943&utmr=-&utmp=%2Fobfuscating-remote-ssh-command-control%2F&utmht=1707011659262&utmac=UA-108467176-2&utmgtm=45He41v0n71WVTQKPv71930088za200&utmcc=__utma%3D205608976.1118232146.1707011659.1707011659.1707011659.1%3B%2B__utmz%3D205608976.1707011659.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=378354231&utmredir=1&utmu=quAgAABAAAGBAAAAAgAAAAAE~

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 36ms
8ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 04 Feb 2024 01:54:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57202
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: hBlfop2tcKX4V1bGNZHbaYMFhrMaxspLXaHhF3qETdwyWd4gJQu6Q2OpcAmi9O2nQWqJkrXUgEM71Db/gextZw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/979774560/ 3 KB
2 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/979774560/?random=1707011659266&cv=11&fst=1707011659266&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71930088za200&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&hn=www.googleadservices.com&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&pscdl=noapi&auid=68326329.1707011659&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c02b21dcfc8d34e267c5555ebc94aac7d7ce864ef091a11f43ff1083d040e8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1380
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 61ms
33ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sun, 04 Feb 2024 01:54:19 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AB226BC1750C400F9072D229B6C94256 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 39ms
8ms Script
application/javascript 146.75.116.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 16:56:53 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kjyo7100081-IAD, cache-fra-eddf8230049-FRA

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 86ms
10ms Script
application/javascript 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:49 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a29-fee9"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17567
expires: Sun, 04 Feb 2024 01:54:19 GMT

GET
H2 200 t2_5ns87trnc_telemetry Show response
conversions-config.reddit.com/v1/pixel/config/ 86 B
424 B 26ms
11ms XHR
application/json 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://conversions-config.reddit.com/v1/pixel/config/t2_5ns87trnc_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
nel: {"report_to":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"success_fraction":0.3,"failure_fraction":0.3}
report-to: {"group":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"endpoints":[{"url":"https://w3-reporting-nel.reddit.com/reports"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
content-length: 86
x-served-by: cache-fra-etou8220071-FRA

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 23ms
7ms Image
image/gif 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1707011659280&id=t2_5ns87trnc&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=e67a907c-5d73-4d26-8184-6bff0e3b2a9b&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_26e8ea0f&dpm=&dpcc=&dprc=
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

POST
H2 200 pdst-events-prod-sink Show response
us-central1-adaptive-growth.cloudfunctions.net/ 2 B
122 B 392ms
391ms Fetch
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Requested by: Host: cdn.pdst.fm
URL: https://cdn.pdst.fm/ping.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json
Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
server: Google Frontend
access-control-allow-methods: GET, POST
content-type: text/html; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: d53ed1ca8bc6faefd948b3a9fd92827f
cache-control: private
function-execution-id: axy97togu0xb
access-control-allow-headers: Content-Type, Accept
content-length: 22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 pdst-events-prod-sink
us-central1-adaptive-growth.cloudfunctions.net/ Frame 0
0 188ms
129ms Preflight
text/html 2001:4860:4802:36::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-central1-adaptive-growth.cloudfunctions.net/pdst-events-prod-sink
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:36::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://redblue42.code42.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: Content-Type, Accept
access-control-allow-methods: GET, POST
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 22
content-type: text/html; charset=utf-8
date: Sun, 04 Feb 2024 01:54:19 GMT
function-execution-id: 99ntbyys2lpd
server: Google Frontend
x-cloud-trace-context: 79865fc12e80a8444e6cb409cff476e1

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 106ms
106ms Stylesheet
text/css 35.156.130.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.156.130.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-130-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6d2d0d7ed37deadd8ed2a5176e86329363ed9ac31bd34b10cd09a94539705a53

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 04 Feb 2024 01:54:19 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 123ms
99ms Fetch
image/jpeg 35.156.130.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.156.130.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-130-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 04 Feb 2024 01:54:19 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 /
www.google.com/pagead/1p-user-list/979774560/ 42 B
455 B 49ms
20ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/979774560/?random=1707011659266&cv=11&fst=1707008400000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71930088za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_ahqTS0IZ6sDmc0HQH16wrQZWrEU5SQ&random=745976755&rmt_tld=0&ipr=y

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/979774560/ 42 B
455 B 49ms
18ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/979774560/?random=1707011659266&cv=11&fst=1707008400000&bg=ffffff&guid=ON&async=1&gtm=45He41v0v71930088za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&label=ESSFCIvLr4EBEODYmNMD&frm=0&tiba=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&npa=0&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_ahqTS0IZ6sDmc0HQH16wrQZWrEU5SQ&random=745976755&rmt_tld=1&ipr=y

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
377 B 236ms
204ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=73e1abe9-a7c9-4726-95aa-c339efd83dfb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=31c42d82-534b-466c-949c-e02e81f009c4&tw_document_href=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0i7&type=javascript&version=2.3.29

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-response-time: 197
date: Sun, 04 Feb 2024 01:54:18 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: f4bfd4e4a33fb213
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 4cf150ee1ccd06c30cb37159d9a948e7e7f08fdf67a7daa1fc40e0b210daace2
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
396 B 231ms
181ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=73e1abe9-a7c9-4726-95aa-c339efd83dfb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=31c42d82-534b-466c-949c-e02e81f009c4&tw_document_href=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0i7&type=javascript&version=2.3.29

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-response-time: 174
date: Sun, 04 Feb 2024 01:54:18 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: bfb3bf585fb23777
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 23446ed54f750a4bed4a3b2361746d7c6052768f4ba2c6387a21162d5d70e362
content-length: 43

GET
H2 200 1385829178350577 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 179ms
177ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1385829178350577?v=2.9.144&r=stable&domain=redblue42.code42.com&hme=44ba03e7b4a66084f0064fdada9e7a7b89f6f2cf807a204d10c6509aeae35209&ex_m=62%2C105%2C93%2C97%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C148%2C151%2C162%2C158%2C159%2C161%2C25%2C89%2C45%2C68%2C160%2C143%2C146%2C155%2C156%2C163%2C114%2C13%2C43%2C167%2C166%2C116%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C94%2C96%2C31%2C95%2C26%2C22%2C144%2C147%2C123%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C92%2C38%2C70%2C60%2C98%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C99

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

72316e492d22dc2af972823146b6e1170931f27994d66c673a032da78cae824b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 04 Feb 2024 01:54:19 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: CnejplPMHrKB0Y+qh//WqqlPMzm+RgfLWXyc1uoLlLDwceusFjGWMbbpigiuSTfPMjyO0dFvx1//ML5KRg4yDw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=*;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uam...
adservice.google.com/ddm/fls/z/ Frame 3D4D 42 B
401 B 71ms
42ms Image
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=*;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F

Requested by

Host: 10192134.fls.doubleclick.net
URL: https://10192134.fls.doubleclick.net/activityi;dc_pre=COzkz_zJkIQDFftHHgIdvkMMdg;src=10192134;type=lpvq10;cat=mm-al0;ord=230114037269;npa=0;auiddc=68326329.1707011659;pscdl=noapi;gtm=45He41v0v71930088za200;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://10192134.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 21000195.js Show response
bat.bing.com/p/action/ 1 KB
839 B 35ms
34ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/21000195.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6395856c1f74118c6f845075098035872fa14d8e6275436961e864aae6968a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Sun, 04 Feb 2024 01:54:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FF261AC79F054903BC4E703E18730950 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
287 B 36ms
36ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=21000195&tm=gtm002&Ver=2&mid=7f529f9d-2a1f-41df-8e50-fb2e740cf640&sid=4f5669f0c30011eebca9a95f409d6d90&vid=4f56c620c30011ee9405c7a84fc0960d&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&p=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&r=&lt=1411&evt=pageLoad&sv=1&rn=728472

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 04 Feb 2024 01:54:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 77281B61CDD2483589BE10A56B1E7020 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
703 B 55ms
13ms XHR
application/json 185.89.211.116
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.211.116 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
an-x-request-uuid: 6226553a-1fee-4191-b91f-e80589668804
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.10.197; 80.255.10.197; 956.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
196 B 28ms
10ms XHR
text/html 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-115-82-10.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://redblue42.code42.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
302 B 70ms
10ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://redblue42.code42.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:5a::4
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1707011659419_388391900_512125162_20_865_7_17_219";dur=1
content-length: 14
expires: Sun, 04 Feb 2024 01:54:19 GMT

GET
H2 200 21000195 Show response
bat.bing.com/p/insights/t/ 724 B
902 B 105ms
105ms Script
application/x-javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/t/21000195

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/action/21000195.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

65274a3695c3b5c1d6a81fea916280757d419db3cdcf9cabe49212d92ca607f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

expires: -1
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sun, 04 Feb 2024 01:54:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8CD995674A2543C084C22C94A96C6688 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
vary: Accept-Encoding
x-azure-ref: 20240204T015419Z-tenk8vunc570d9ch9n84288yh000000001tg0000000049pb
content-type: application/x-javascript
x-cache: CONFIG_NOCACHE
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 614
request-context: appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 204ms
193ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 205ms
194ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%220bec2a4eca6570c7f3f4c5479d608b0e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%228832052cf3a17f48f7a1c2a260db7fd0371cb3eb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 138 B
335 B 101ms
100ms XHR
text/plain 35.156.130.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=Qj_LCZmHF4CpXTmVPFE52w&is_js=true&landing_url=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&t=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&tip=FJgY_wYLmdCaT_7GNV3wiAowZlbJLdtS5jP6ptMelys&host=https%3A%2F%2Fredblue42.code42.com&sa_conv_data_css_value=%270-71dd7de1-86fc-502e-723f-073507e3e411%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd971dd7de186fc502e723f073507e3e41150ff0ac5&sa-user-id-v3=s%253AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDL3PutBjABOgQXuSKpQgRCzEO-.lHqm1LZWy%252BWRCXFGDlB%252Bb%252BfbYNLSFDRp7Goc8XUeZLA&sa-user-id-v2=s%253Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM&sa-user-id=s%253A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%252Fs92iJd5EElxltBKT0Di%252FDkySJ%252Bs
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.156.130.186 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-130-186.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 63b0425d066209894571135b8fbc4671c7dc015f3a4ca057436fe915b757aaee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: https://redblue42.code42.com
date: Sun, 04 Feb 2024 01:54:19 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 138
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 192ms
191ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A5a%3A%3A4%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Obfuscating%20Remote%20SSH%20Command%20%26amp%3B%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 l
use.typekit.net/af/7a16a7/000000000000000077359568/30/ 31 KB
31 KB 38ms
7ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/7a16a7/000000000000000077359568/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n1&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1022542ce1051bbe004c510dafb3b78fbddef5e009d5c1d65bd3583d2de1816b

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "f38232765146dfc7b671501d05dda4b2e87e422b"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 31908

GET
H2 200 l
use.typekit.net/af/e4b1a9/000000000000000077359571/30/ 32 KB
33 KB 53ms
23ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/e4b1a9/000000000000000077359571/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 2ad1a3ce85195c70b579486b5b5b7721a42a5613b35e4a96e68a2d95bced9a3a

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "b10a19accac4d75934ead3e517526b740bdb5a2c"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33156

GET
H2 200 l
use.typekit.net/af/eb4c83/000000000000000077359574/30/ 34 KB
34 KB 52ms
22ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/eb4c83/000000000000000077359574/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i6&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 92fa1843f2d35f8e3162b8c0973fedd4f98b21d92c13af8a6a9ed2aee07b8c2e

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "509cb6be19faece2301894a4515ff0f853591398"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34416

GET
H2 200 l
use.typekit.net/af/d45b9a/000000000000000077359577/30/ 33 KB
33 KB 39ms
9ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d45b9a/000000000000000077359577/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: ccaac2a8b85879c92bbd73e67512e8e8ab0e719ad0163193081ea6abb20031cc

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "f806d2fcac6bea1cced8320378bba8659e3a95e8"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 33364

GET
H2 200 l
use.typekit.net/af/6cc429/00000000000000007735957a/30/ 35 KB
35 KB 46ms
16ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/6cc429/00000000000000007735957a/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9c021e60f7e8b7b4ad3672c21529c74f9a1553b36d2131c9b30c73a8aa83ca51

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "e32f2e1468d1ab6c324774fe08a8c96298c1ca86"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 35416

GET
H2 200 l
use.typekit.net/af/56b0cd/00000000000000007735957d/30/ 34 KB
34 KB 45ms
15ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/56b0cd/00000000000000007735957d/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 3be30c09a4c2a44586ae9710ad7c61e5b9e57ba9d24935ad3e6f61aca28b9b06

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "efd2a4eb0e71949802f825497dfc78423b4eaac3"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 34328

GET
H2 200 l
use.typekit.net/af/fcae55/000000000000000077359580/30/ 36 KB
36 KB 51ms
21ms Font
application/font-woff2 2a02:26f0:480:f::213:7ec6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/fcae55/000000000000000077359580/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i3&v=3
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 674b01b85935624f22a298fe520a7caab5052aa1f094c16b9aa2c060227630b0

Request headers

Referer: https://redblue42.code42.com/
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
etag: "d2d12fd9ab38ddf939d2f4897e992ad8e28acc1e"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 36476

GET
H2 200 0.7.20 Show response
bat.bing.com/p/insights/s/ 34 KB
15 KB 38ms
36ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/s/0.7.20

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/insights/t/21000195

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5ab142585097949ade33d1c1c15cf8df7423d78bd45747965c064882e72f83e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Sun, 04 Feb 2024 01:54:19 GMT
x-cache: CONFIG_NOCACHE
x-fd-int-roxy-purgeid: 51562430
content-length: 14592
last-modified: Wed, 24 Jan 2024 14:34:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A91DD0A17AF044AC84BC7409E2793CE8 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
etag: W/"0x8DC1CE988AFCDA8"
vary: Accept-Encoding
x-azure-ref: 20240204T015419Z-9g987u728t3671w2q9a2z2kaf400000001hg0000000033xc
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 6334a82d-101e-0038-6b43-568a1b000000
cache-control: public, max-age=86400
x-ms-version: 2018-03-28

GET
H2 200 p.gif
p.typekit.net/ 35 B
205 B 76ms
9ms Image
image/gif 2a02:26f0:280:6::213:7ac7
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.typekit.net/p.gif?s=1&k=zlu5bge&ht=tk&h=redblue42.code42.com&f=171.173.174.175.176.5474.5475&a=128252755&js=1.21.0&app=typekit&e=js&_=1707011659508
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:280:6::213:7ac7 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
last-modified: Fri, 28 Jul 2023 12:57:07 GMT
server: nginx
etag: "64c3bb23-23"
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 725 B
674 B 28ms
12ms XHR
application/json 52.57.226.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.226.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
Authorization: Token 8832052cf3a17f48f7a1c2a260db7fd0371cb3eb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
X-6s-CustomID: WebTag1.0 0bec2a4eca6570c7f3f4c5479d608b0e

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://redblue42.code42.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 387

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 44ms
10ms Preflight 52.57.226.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.226.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-226-31.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://redblue42.code42.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://redblue42.code42.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Sun, 04 Feb 2024 01:54:19 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 32ms
7ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1385829178350577&ev=PageView&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&rl=&if=false&ts=1707011659536&sw=1600&sh=1200&v=2.9.144&r=stable&ec=0&o=4126&fbp=fb.1.1707011659535.139029402&ler=empty&cdl=API_unavailable&it=1707011659344&coo=false&dpo=LDU&dpoco=1&dpost=1000&exp=e1&rqm=GET

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 04 Feb 2024 01:54:19 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WVTQKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 04 Feb 2024 01:30:43 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1416
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 04 Feb 2024 03:30:43 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
212 B 14ms
14ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1192520943&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_utma=205608976.1118232146.1707011659.1707011659.1707011659.1&_utmz=205608976.1707011659.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707011659643&_u=YQBCAAABAAAAAC~&jid=1453673882&gjid=1545462898&cid=1118232146.1707011659&tid=UA-775547-16&_gid=1005195175.1707011660&_r=1&_slc=1&gtm=45He41v0n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=891354456

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 n Show response
bat.bing.com/p/insights/c/ 0
212 B 106ms
105ms XHR
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/n

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/p/insights/s/0.7.20

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/x-webinsights-gzip
Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 04 Feb 2024 01:54:19 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 77408F9FC84C438C87B63819187C72F8 Ref B: FRA31EDGE0515 Ref C: 2024-02-04T01:54:19Z
vary: Origin
x-cache: CONFIG_NOCACHE
access-control-allow-origin: https://redblue42.code42.com
access-control-allow-credentials: true
request-context: appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:51:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 166
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 04 Feb 2024 02:51:33 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
352 B 57ms
19ms XHR
text/plain 2a00:1450:400c:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1453673882&gjid=1545462898&_gid=1005195175.1707011660&_u=YQBCAAAAAAAAAC~&z=580580176

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 48ms
19ms XHR
text/plain 2a00:1450:400c:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1096035853&gjid=1791677085&_gid=1005195175.1707011660&_u=aSDCgEAjAAAAAGAAI~&z=499757676

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://redblue42.code42.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://redblue42.code42.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1192520943&t=pageview&_s=1&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=205608976.1118232146.1707011659.1707011659.1707011659.1&_utmz=205608976.1707011659.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707011659672&_u=aSDCgEAjAAAAACAAI~&jid=1096035853&gjid=1791677085&cid=1118232146.1707011659&tid=UA-775547-16&_gid=1005195175.1707011660&gtm=45He41v0n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd8=&z=378484048

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Feb 2024 18:51:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25347
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
6ms Image
image/gif 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1192520943&t=timing&_s=2&dl=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&ul=en-us&de=UTF-8&dt=Obfuscating%20Remote%20SSH%20Command%20%26%20Control%20%E2%80%93%20Security%20Ops%20and%20Researcher%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=1807&pdt=1&dns=0&rrt=0&srt=481&tcp=20&dit=1411&clt=1411&_gst=1755&_gbt=1791&_utma=205608976.1118232146.1707011659.1707011659.1707011659.1&_utmz=205608976.1707011659.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)&_utmht=1707011659686&_u=aSDCgEAjAAAAAGAAI~&jid=&gjid=&cid=1118232146.1707011659&tid=UA-775547-16&_gid=1005195175.1707011660&gtm=45He41v0n71WVTQKPv71930088za200&cd12=&cd13=&cd14=Germany&cd15=Berlin&cd16=Berlin&cd17=&cd18=&cd19=&cd20=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd8=&z=765632318

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 03 Feb 2024 18:51:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25347
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 20ms
18ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1453673882&_u=YQBCAAAAAAAAAC~&z=1702646327

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 18ms
17ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1453673882&_u=YQBCAAAAAAAAAC~&z=1702646327

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 18ms
17ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1096035853&_u=aSDCgEAjAAAAAGAAI~&z=1508808541

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 19ms
18ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-775547-16&cid=1118232146.1707011659&jid=1096035853&_u=aSDCgEAjAAAAAGAAI~&z=1508808541

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 04 Feb 2024 01:54:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 posts Show response
redblue42.code42.com/wp-json/wp/v2/ 13 KB
5 KB 240ms
240ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/posts?categories=4863&exclude[]=8380&per_page=2

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

e0a25ec1d20e06a528e824efeb1ac19ed7e1f4b5b8dfbdf9790c7e85ce1df4df

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:19 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: MISS
alt-svc: h3=":443"; ma=86400
server: cloudflare
x-wp-totalpages: 14
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-wp-total: 28
x-robots-tag: noindex
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
link: <https://redblue42.code42.com/wp-json/wp/v2/posts?categories%5B0%5D=4863&exclude%5B0%5D=8380&per_page=2&page=2>; rel="next"
cf-ray: 84ff48f969086916-FRA

GET
H3 200 heroiccondweb-bold.woff
redblue42.code42.com/wp-content/themes/c42-blog-wp-theme//assets/fonts/ 24 KB
24 KB 470ms
470ms Font
font/woff 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme//assets/fonts/heroiccondweb-bold.woff
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e287d9b33034349168f1dde3d59659330cadd29d98d68236853f3a21fa21386

Request headers

Referer: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/bundle.css?ver=6.4.2
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
cf-cache-status: MISS
last-modified: Tue, 20 Dec 2022 22:09:12 GMT
server: cloudflare
etag: "63a23288-5f5c"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84ff48faf9966916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 24412

GET
H3 200 142 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
873 B 477ms
476ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/142

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 1
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 84ff48fb199d6916-FRA

GET
H3 200 142 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
873 B 130ms
130ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/142

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 1
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 84ff48fb199e6916-FRA

GET
DATA 200
OK truncated
/ 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ba496cd9446a1746e36b3f6910291a52350db7cddedebabfc7df3afb47e7a9bd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 159 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
858 B 478ms
477ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/159

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 3
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 84ff48fb199f6916-FRA

GET
H3 200 159 Show response
redblue42.code42.com/wp-json/wp/v2/users/ 1 KB
858 B 471ms
471ms XHR
application/json 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://redblue42.code42.com/wp-json/wp/v2/users/159

Requested by

Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/themes/c42-blog-wp-theme/dist/app/bundle.js?ver=20171210

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
x-cache-group: normal
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-cacheable: SHORT
content-encoding: br
x-powered-by: WP Engine
x-cache: HIT: 2
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding,Cookie
allow: GET
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
cache-control: max-age=600, must-revalidate
x-robots-tag: noindex
link: <https://redblue42.code42.com/wp-json/>; rel="https://api.w.org/"
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
cf-ray: 84ff48fb19a06916-FRA

GET
H3 200 T552RDEDB-ULHCM4PEC-cce960a31ad8-512-1-150x150.jpg
redblue42.code42.com/wp-content/uploads/2019/12/ 3 KB
3 KB 473ms
472ms Image
image/jpeg 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2019/12/T552RDEDB-ULHCM4PEC-cce960a31ad8-512-1-150x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6188cf8cdc4ace1742d1df11d97d709e074046e56060edb33b77eaba1ef72272

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
cf-cache-status: MISS
last-modified: Tue, 10 Dec 2019 20:46:12 GMT
server: cloudflare
etag: "5df00414-c9d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84ff48fbe9df6916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 3229

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 192ms
192ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A20%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A19%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 laura-150x150.jpg
redblue42.code42.com/wp-content/uploads/2021/12/ 8 KB
8 KB 472ms
471ms Image
image/jpeg 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redblue42.code42.com/wp-content/uploads/2021/12/laura-150x150.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 750570e0f92396e778a9bd7e76b404fdb29be65199d30e1e2701b75438b7bc6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:20 GMT
cf-cache-status: MISS
last-modified: Thu, 09 Dec 2021 21:08:44 GMT
server: cloudflare
etag: "61b2705c-213d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84ff48fe0b186916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 8509

GET
H3 200 nunito-v8-latin-700.woff2
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/ 18 KB
19 KB 474ms
472ms Font
font/woff2 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/nunito-v8-latin-700.woff2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cdc28355b0b7217392395460dd7dfbc65a4cf0822c986a7533f4ca7434799e53

Request headers

Referer: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:21 GMT
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: "6491f7d8-49e0"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84ff49030dc16916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 18912

GET
H3 200 nunito-v8-latin-regular.woff2
redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/ 18 KB
19 KB 473ms
471ms Font
font/woff2 141.193.213.10
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/fonts/nunito-v8-latin-regular.woff2
Requested by: Host: redblue42.code42.com
URL: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 623b62596e07df1fbf3a9fc0219c238e373bec6e55349826b0315b50ed2a7a7d

Request headers

Referer: https://redblue42.code42.com/wp-content/plugins/gdpr-cookie-compliance/dist/styles/gdpr-main.css?ver=4.12.3
Origin: https://redblue42.code42.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:21 GMT
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 19:02:48 GMT
server: cloudflare
etag: "6491f7d8-496c"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 84ff49031dc26916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 18796

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 188ms
188ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A21%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A20%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:21 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 193ms
192ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A22%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A21%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223007%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:22 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 193ms
192ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A23%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A22%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:23 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 193ms
192ms Image
image/gif 104.115.82.10
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=0bec2a4eca6570c7f3f4c5479d608b0e&svisitor=null&visitor=fe9cb2b3-3dd7-4cd9-8967-c21f312b318d&session=1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A24%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2004%20Feb%202024%2001%3A54%3A23%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225011%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Security%20Ops%20and%20Researcher%20Blog%20-%20Security%20Ops%20and%20Researcher%20Blog%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredblue42.code42.com%2Fobfuscating-remote-ssh-command-control%2F&pageViewId=057e8b57-2dfa-4653-863a-4689c2af648c&an_uid=0&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.115.82.10 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a104-115-82-10.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://redblue42.code42.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sun, 04 Feb 2024 01:54:24 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

58 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-21 03:46:11	Name: __utma Value: 205608976.1118232146.1707011659.1707011659.1707011659.1
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1969-12-31 23:59:59	Name: __utmc Value: 205608976
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 22:32:59	Name: __utmz Value: 205608976.1707011659.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 18:10:12	Name: __utmt_UA-108467176-2 Value: 1
.redblue42.code42.com/obfuscating-remote-ssh-command-control	1970-01-20 18:10:13	Name: __utmb Value: 205608976.1.10.1707011659
.redblue42.code42.com/	1970-01-20 18:10:13	Name: __cf_bm Value: vwpRZ88B9rt30lP7L083O.vFyX.Tkh470gm8eFBRSMI-1707011658-1-Ac1iReVkq7ptBNog/SxZfW6fC0V1DtKLc5RgtWgDvyR1xI1o/pStRp3G4BeNLBUm/szNlNyJlj/yvK8EgHwEYPE=
.code42.com/	1970-01-20 20:19:47	Name: _gcl_au Value: 1.1.68326329.1707011659
.gumgum.com/	1970-01-21 02:55:47	Name: cs Value: true
.code42.com/	1970-01-20 20:19:47	Name: _rdt_uuid Value: 1707011659279.e67a907c-5d73-4d26-8184-6bff0e3b2a9b
redblue42.code42.com/	1970-01-21 02:55:47	Name: __pdst Value: 9c94aa8e794d48d78b200dc60fc87bb6
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_source Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_medium Value: (none)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_campaign Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_content Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_term Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_adgroup Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: last_asset_accessed Value: Obfuscating Remote SSH Command & Control – Security Ops and Researcher Blog
redblue42.code42.com/	1969-12-31 23:59:59	Name: last_asset_accessed_url Value: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_business_unit Value: ent
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_campaign_name Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: utm_channel Value: Direct
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_campaign Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_source Value: (direct)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_medium Value: (none)
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_term Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_content Value: none
redblue42.code42.com/	1969-12-31 23:59:59	Name: original_utm_creation Value: 1
tags.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id Value: s%3A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%2Fs92iJd5EElxltBKT0Di%2FDkySJ%2Bs
.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id Value: s%3A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%2Fs92iJd5EElxltBKT0Di%2FDkySJ%2Bs
tags.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id-v2 Value: s%3Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id-v2 Value: s%3Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
tags.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id-v3 Value: s%3AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDL3PutBjABOgQXuSKpQgRCzEO-.lHqm1LZWy%2BWRCXFGDlB%2Bb%2BfbYNLSFDRp7Goc8XUeZLA
.srv.stackadapt.com/	1970-01-21 02:55:47	Name: sa-user-id-v3 Value: s%3AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDL3PutBjABOgQXuSKpQgRCzEO-.lHqm1LZWy%2BWRCXFGDlB%2Bb%2BfbYNLSFDRp7Goc8XUeZLA
.doubleclick.net/	1970-01-20 18:10:12	Name: test_cookie Value: CheckForPermission
redblue42.code42.com/	1970-01-21 02:55:47	Name: sa-user-id Value: s%253A0-71dd7de1-86fc-502e-723f-073507e3e411.gJ3Q7T8dihVV4kY%252Fs92iJd5EElxltBKT0Di%252FDkySJ%252Bs
redblue42.code42.com/	1970-01-21 02:55:47	Name: sa-user-id-v2 Value: s%253Acd194Yb8UC5yPwc1B-PkEVD_CsU.TnpfKlYmtCKzss31Mqis7zNjvmp3LFVkOPfpIZt1wpM
redblue42.code42.com/	1970-01-21 02:55:47	Name: sa-user-id-v3 Value: s%253AAQAKIJjH3KynR_K20At5lKA5NE8yTuaVi2Vcc7nsxYOXgyoZEHwYBCDL3PutBjABOgQXuSKpQgRCzEO-.lHqm1LZWy%252BWRCXFGDlB%252Bb%252BfbYNLSFDRp7Goc8XUeZLA
.doubleclick.net/	1970-01-20 22:29:23	Name: receive-cookie-deprecation Value: 1
.bing.com/	1970-01-21 03:31:47	Name: MUID Value: 2AFF76C0F57F66430DFC62DBF4F46721
.adnxs.com/	1970-01-21 03:46:11	Name: receive-cookie-deprecation Value: 1
redblue42.code42.com/	1970-01-20 18:20:16	Name: _an_uid Value: 0
redblue42.code42.com/	1970-01-21 03:46:11	Name: _gd_visitor Value: fe9cb2b3-3dd7-4cd9-8967-c21f312b318d
redblue42.code42.com/	1970-01-20 18:10:26	Name: _gd_session Value: 1055b1c3-5271-4c5e-8bb5-bdf7a9f0355d
.bat.bing.com/	1970-01-21 03:31:47	Name: MSPTC Value: CUxn4zwDmg1QAH9glKZh1ABqIG6FOjD_H4hT1r4Cfe0
.code42.com/	1970-01-20 20:19:47	Name: _fbp Value: fb.1.1707011659535.139029402
.code42.com/	1970-01-20 18:11:38	Name: _uetsid Value: 4f5669f0c30011eebca9a95f409d6d90\|1r2cnjx\|2\|fiz\|0\|1495
.ipredictive.com/	1970-01-21 02:55:47	Name: cu Value: 4ff06576-34f3-4462-b793-782a5a50b08a\|1707011659505
.twitter.com/	1970-01-21 03:46:11	Name: personalization_id Value: "v1_aKamA8+t0mZJ1BBiWuJczg=="
.t.co/	1970-01-21 03:46:11	Name: muc_ads Value: 3ccd5ec1-4b59-4327-9ab5-d8c69cfe71f8
.6sc.co/	1970-01-21 03:46:11	Name: 6suuid Value: 06527368750112004beebe65770200008edc0b00
.redblue42.code42.com/	1970-01-21 03:46:11	Name: _ga Value: GA1.3.1118232146.1707011659
.redblue42.code42.com/	1970-01-20 18:11:38	Name: _gid Value: GA1.3.1005195175.1707011660
.redblue42.code42.com/	1970-01-20 18:10:11	Name: _gat_UA-775547-16 Value: 1
.code42.com/	1970-01-21 03:46:11	Name: _ga Value: GA1.2.1118232146.1707011659
.code42.com/	1970-01-20 18:11:38	Name: _gid Value: GA1.2.1005195175.1707011660
.redblue42.code42.com/	1970-01-21 02:55:47	Name: internalTraffic Value: false
.code42.com/	1970-01-20 18:10:11	Name: _dc_gtm_UA-775547-16 Value: 1
.code42.com/	1970-01-21 03:31:47	Name: _uetvid Value: 4f56c620c30011ee9405c7a84fc0960d\|pu1h79\|1707011659759\|1\|1\|bat.bing.com/p/insights/c/n

46 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://redblue42.code42.com/wp-content/uploads/2016/11/Code42-blog-bio-logo-96x96.jpg Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1385829178350577?v=2.9.144&r=stable&domain=redblue42.code42.com&hme=44ba03e7b4a66084f0064fdada9e7a7b89f6f2cf807a204d10c6509aeae35209&ex_m=62%2C105%2C93%2C97%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C148%2C151%2C162%2C158%2C159%2C161%2C25%2C89%2C45%2C68%2C160%2C143%2C146%2C155%2C156%2C163%2C114%2C13%2C43%2C167%2C166%2C116%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C94%2C96%2C31%2C95%2C26%2C22%2C144%2C147%2C123%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C92%2C38%2C70%2C60%2C98%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C99(Line 95) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://redblue42.code42.com/obfuscating-remote-ssh-command-control/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10192134.fls.doubleclick.net
ad.ipredictive.com
adservice.google.com
alb.reddit.com
analytics.twitter.com
b.6sc.co
bat.bing.com
c.6sc.co
cdn.pdst.fm
connect.facebook.net
conversions-config.reddit.com
epsilon.6sense.com
googleads.g.doubleclick.net
ipv6.6sc.co
j.6sc.co
p.typekit.net
px.adentifi.com
px.gumgum.com
redblue42.code42.com
secure.adnxs.com
ssl.google-analytics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.srv.stackadapt.com
us-central1-adaptive-growth.cloudfunctions.net
use.typekit.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.redditstatic.com
104.115.82.10
104.244.42.133
104.244.42.67
141.193.213.10
142.250.181.230
146.75.116.157
151.101.129.140
151.101.65.140
18.214.166.242
185.89.211.116
2001:4860:4802:36::36
2620:1ec:c11::200
2a00:1450:4001:806::2004
2a00:1450:4001:80b::2003
2a00:1450:4001:80e::2008
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2002
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2002
2a00:1450:400c:c07::9a
2a02:26f0:280:6::213:7ac7
2a02:26f0:480:23::1726:629c
2a02:26f0:480:f::213:7ec6
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
2a04:4e42:400::396
35.156.130.186
35.244.142.80
52.210.29.170
52.57.226.31
52.73.1.39
07ebc53457e2eb61f40b14b53b18ec28222ed7d0f11ccdd9145e37bde647f85e
1022542ce1051bbe004c510dafb3b78fbddef5e009d5c1d65bd3583d2de1816b
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
14c77827fd23522626db314fb4127b7aa0bdc6b26059e1b49a9483ee3ccf89c3
17c1788bf2f16e188cf73d0038249aec4d32ae8145128b0a27f3c7dc3f9fed74
22cf1baba55eced80d7ebb0de51fc8961757ef581964f8e10ebc8676399eba81
25c419e5b4c69dd558a793817507404ae9f9b40a5f20d018737e205af400c473
2ad1a3ce85195c70b579486b5b5b7721a42a5613b35e4a96e68a2d95bced9a3a
2d699428fb1a87452cb15775f3e9a531b9c8a98bfa41be2a24be4814ff0a5baf
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
36649911dda94e1f560545e87e5b36d0ce3562af26f507846e73f0d93e58242a
3be30c09a4c2a44586ae9710ad7c61e5b9e57ba9d24935ad3e6f61aca28b9b06
49d592cada7fbcf6117179df4c762c2a3429711063a0ac828d653644751f9867
4c89ae030f2ad83ccb7a1eb37b5d8165bbe6f89ce18d80cab12c105e5d203ca3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5ab142585097949ade33d1c1c15cf8df7423d78bd45747965c064882e72f83e6
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
6188cf8cdc4ace1742d1df11d97d709e074046e56060edb33b77eaba1ef72272
623b62596e07df1fbf3a9fc0219c238e373bec6e55349826b0315b50ed2a7a7d
6395856c1f74118c6f845075098035872fa14d8e6275436961e864aae6968a98
63b0425d066209894571135b8fbc4671c7dc015f3a4ca057436fe915b757aaee
65274a3695c3b5c1d6a81fea916280757d419db3cdcf9cabe49212d92ca607f6
674b01b85935624f22a298fe520a7caab5052aa1f094c16b9aa2c060227630b0
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6d2d0d7ed37deadd8ed2a5176e86329363ed9ac31bd34b10cd09a94539705a53
72316e492d22dc2af972823146b6e1170931f27994d66c673a032da78cae824b
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
750570e0f92396e778a9bd7e76b404fdb29be65199d30e1e2701b75438b7bc6b
7e287d9b33034349168f1dde3d59659330cadd29d98d68236853f3a21fa21386
7ff92d36b8a48bdd606863262f2c5e68725a0c48346df2c4bfd3f35ea52acd91
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
92fa1843f2d35f8e3162b8c0973fedd4f98b21d92c13af8a6a9ed2aee07b8c2e
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9c021e60f7e8b7b4ad3672c21529c74f9a1553b36d2131c9b30c73a8aa83ca51
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
ba496cd9446a1746e36b3f6910291a52350db7cddedebabfc7df3afb47e7a9bd
bbf620d916dd02df52101b38cce6ba7d75188addc751307fb9c055bfc93cdab0
c02b21dcfc8d34e267c5555ebc94aac7d7ce864ef091a11f43ff1083d040e8ba
c4eb9f6ec0d65558cdb13be19ab0315136ca1d8ab2f1f7a54cc5873702913f60
c68250e72b79404e412f4c56f79f73430f1d1a840d2aa802793ed2f60d26cfc4
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cb8d40d1eb7e2dc885affcf0012d9e1a73c270d843e8b890d36538e52d0a0342
ccaac2a8b85879c92bbd73e67512e8e8ab0e719ad0163193081ea6abb20031cc
cdc28355b0b7217392395460dd7dfbc65a4cf0822c986a7533f4ca7434799e53
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d454566fbbab8fcbc70a1c3139be25be5205712442564fe24a5e0258e3337a98
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de58d23922dd836c182546143a9ffebaeb75d317f99fcd9f0049be20e8ca5f0a
e0a25ec1d20e06a528e824efeb1ac19ed7e1f4b5b8dfbdf9790c7e85ce1df4df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee990ab4c2f2f268f92a4cb10be71e58162d6d033eb1213055e5c4814045c1cd
eeaf3c16ad06374da5c973a0280d21b5655c95ffcee986d6edb9ce7f877ea283
eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7c8c0bbc379cec12f50ead8f01a51b802dda7973d2473513557e85b5613bbba
f8a01afc25491b290978ac6fdb80b200a81c08029ca1389a14e00357294d51fe
fbb3bcb80a056423c4e9c19e56998a54ac7444913f387f2294acd76786fad9dc
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

redblue42.code42.com Open in urlscan Pro 141.193.213.10 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

88 Requests

100 %HTTPS

52 %IPv6

24 Domains

33 Subdomains

32 IPs

4 Countries

1003 kBTransfer

2946 kBSize

58 Cookies

8 Outgoing links

Redirected requests

88 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

redblue42.code42.com Open in urlscan Pro
141.193.213.10 Public Scan

Screenshot
Live screenshot

Full Image

88
Requests

100 %
HTTPS

52 %
IPv6

24
Domains

33
Subdomains

32
IPs

4
Countries

1003 kB
Transfer

2946 kB
Size

58
Cookies

88 HTTP transactions
4 data transactions