thinkdfir.com | ThinkDFIR – random musings on DFIR

Robots.txt Information

Robot	Path	Permission
GoogleBot	/	✔
BingBot	/	✔
BaiduSpider	/	✔
YandexBot	/	✔
# If you are regularly crawling WordPress.com sites, please use our firehose to receive real-time push updates instead. # Please see https://developer.wordpress.com/docs/firehose/ for more details. Sitemap: https://thinkdfir.com/sitemap.xml Sitemap: https://thinkdfir.com/news-sitemap.xml User-agent: * Disallow: /wp-admin/ Allow: /wp-admin/admin-ajax.php Disallow: /wp-login.php Disallow: /wp-signup.php Disallow: /press-this.php Disallow: /remote-login.php Disallow: /activate/ Disallow: /cgi-bin/ Disallow: /mshots/v1/ Disallow: /next/ Disallow: /public.api/ # This file was generated on Thu, 02 Feb 2023 02:51:26

Meta Tags

Title	ThinkDFIR – random musings on DFIR
Description	random musings on DFIR
Keywords	N/A

Server Information

WebSite	thinkdfir.com
Host IP	192.0.78.25
Location	United States

Related Websites

                        Site
                        Rank
                    

More to Explore

thinkdfir.com Valuation

US$351,140

Last updated: 2023-05-16 02:43:37

thinkdfir.com has Semrush global rank of 30,142,727. thinkdfir.com has an estimated worth of US$ 351,140, based on its estimated Ads revenue. thinkdfir.com receives approximately 40,517 unique visitors each day. Its web server is located in United States, with IP address 192.0.78.25. According to SiteAdvisor, thinkdfir.com is safe to visit.

Traffic & Worth Estimates

Purchase/Sale Value	US$351,140
Daily Ads Revenue	US$325
Monthly Ads Revenue	US$9,724
Yearly Ads Revenue	US$116,687
Daily Unique Visitors	2,702
Note: All traffic and earnings values are estimates.

DNS Records

Host	Type	TTL	Data
thinkdfir.com.	A	300	IP: 192.0.78.25
thinkdfir.com.	A	300	IP: 192.0.78.24
thinkdfir.com.	NS	86400	NS Record: ns3.wordpress.com.
thinkdfir.com.	NS	86400	NS Record: ns2.wordpress.com.
thinkdfir.com.	NS	86400	NS Record: ns1.wordpress.com.

HtmlToTextCheckTime:2023-05-16 02:43:37

Open Menu About Contact Find Me Posts LinkedIn Twitter GitHub This Week In 4n6 Search Search for: Close ThinkDFIR random musings on DFIR topics Timestamps in INDX Entries January 13, 2023 January 24, 2023 Phill Moore 1 Comment Welcome to 2023! Turns out I didn’t post on here as much as I should have last year. Logging in this morning I can see I posted twice, whoops. Let’s change that with some validation research into INDX records, particularly in relation to the timestamps that are stored in INDX entries. I’ve been putting together my talk for the upcoming Magnet Virtual Summit , and my talk is about carving out forensic artefacts from an encrypted VHDX file that I had during an ransomware investigation last year. During my investigation I had to use a variety of tools to piece together a timeline of activity from a blob of partially encrypted data, which was an interesting process. One of the artefacts that I used was INDX records, which has lead me to play with a number of

HTTP Headers

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 17 Jan 2022 11:02:23 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://thinkdfir.com/
X-ac: 3.arn _dca 

HTTP/2 200 
server: nginx
date: Mon, 17 Jan 2022 11:02:23 GMT
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
vary: Accept-Encoding
vary: Cookie
x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
host-header: WordPress.com
link: ; rel=shortlink
x-ac: 3.arn _dca

thinkdfir.com Whois Information

Domain Name: THINKDFIR.COM
Registry Domain ID: 2154606069_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.sawbuck.com
Registrar URL: http://www.wordpress.com
Updated Date: 2021-07-19T16:09:12Z
Creation Date: 2017-08-18T02:14:43Z
Registry Expiry Date: 2022-08-18T02:14:43Z
Registrar: Automattic Inc.
Registrar IANA ID: 1531
Registrar Abuse Contact Email: domainabuse@automattic.com
Registrar Abuse Contact Phone: +1 877 273-3049
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.WORDPRESS.COM
Name Server: NS2.WORDPRESS.COM
Name Server: NS3.WORDPRESS.COM
DNSSEC: unsigned
>>> Last update of whois database: 2022-01-17T08:12:38Z <<<

thinkdfir.com valuation and analysis