nmap -sV --recon self
Every connection leaves a trace. Here's what yours reveals, plotted on the MITRE ATT&CK® framework — resolved entirely against your own request, right now. Only the Reconnaissance tactic is ever performed here; every other tactic below is shown for context and never actually executed. This is a representative sample, not the full framework — MITRE ATT&CK documents far more techniques per tactic than could reasonably fit on one page. Click any technique to expand it and see how that information would be retrieved and how to defend against it.
$ cat observed_summary.log
- IP address
- 216.73.217.80
- Location
- Columbus, Ohio, United States
- Network / ISP
- Amazon.com (AS16509 Amazon.com, Inc.) · proxy/vpn: no · hosting: yes
- Browser / OS
- Bot/Script / Unknown
- Device type
- Bot
- Reverse DNS
- no PTR record
T1590.005 observed Gather Victim Network Info: IP Addresses
Observed value: 216.73.217.80
How this was retrieved: Your IP address is read directly from the incoming TCP connection (or the X-Forwarded-For header, for requests behind a trusted proxy).
Remediation: Route your traffic through a VPN, Tor, or a trusted proxy to mask your origin IP address.
T1591.001 observed Gather Victim Org Info: Determine Physical Locations
Observed value: Columbus, Ohio, United States
How this was retrieved: Your IP address is looked up server-side against a third-party IP-geolocation database to estimate city, region, and country.
Remediation: Use a VPN with exit nodes in a different region to prevent accurate geolocation from your IP alone.
T1590 observed Gather Victim Network Information
Observed value: Amazon.com (AS16509 Amazon.com, Inc.) · proxy/vpn: no · hosting: yes
How this was retrieved: The same geolocation lookup also returns the network operator, ASN, and flags for known proxy/hosting IP ranges.
Remediation: Use infrastructure not flagged as a public hosting/proxy range, or accept that VPN/hosting exits are visible as such.
T1592.004 observed Gather Victim Host Info: Client Configurations
Observed value: Bot/Script / Unknown
How this was retrieved: Your browser sends a User-Agent header on every request, disclosing browser family, version, and operating system — plus, where present, an Accept-Language header revealing your preferred locale.
Remediation: Use a privacy-hardened browser (e.g. Tor Browser) or a User-Agent-normalizing extension to reduce fingerprintable detail.
T1592.001 observed Gather Victim Host Info: Hardware
Observed value: Bot
How this was retrieved: Device class (desktop, mobile, tablet) is inferred from patterns in the same User-Agent string.
Remediation: A normalized or spoofed User-Agent hides device-class signals along with browser/OS details.
T1590.002 observed Gather Victim Network Info: DNS
Observed value: no PTR record
How this was retrieved: A reverse DNS (PTR) lookup is performed server-side against your IP address to find any associated hostname.
Remediation: Make sure your ISP or VPN provider doesn't assign a PTR record that discloses your name, employer, or hosting account.
T1589 context Gather Victim Identity Information
Not performed by this site — shown for context only.
How this technique works: In a real engagement this covers OSINT on employee names, emails, and credentials — e.g. breach-data lookups, social media, or public code commits.
Remediation: Minimize employee PII on public profiles, use role-based email aliases, and monitor breach-notification services for your domain.
T1598 context Phishing for Information
Not performed by this site — shown for context only.
How this technique works: Pretexted emails, forms, or calls are used to trick a target into directly revealing information.
Remediation: Security-awareness training, email authentication (SPF/DKIM/DMARC), and verifying unusual requests out-of-band.
T1583 context Acquire Infrastructure
Not performed by this site — shown for context only.
How this technique works: Servers, domains, and cloud accounts are bought or rented to host payloads and command-and-control infrastructure.
Remediation: Monitor for lookalike domains registered against your brand and use DNS threat-intel feeds to flag newly observed infrastructure.
T1587 context Develop Capabilities
Not performed by this site — shown for context only.
How this technique works: Custom malware, exploits, or certificates are built in a private lab environment ahead of an operation.
Remediation: Behavior-based EDR and application allow-listing reduce the payoff of novel, purpose-built tooling.
T1588 context Obtain Capabilities
Not performed by this site — shown for context only.
How this technique works: Rather than building tools, exploits, malware, or stolen credentials are bought or downloaded from criminal marketplaces.
Remediation: Patch quickly to shorten the useful life of purchasable exploits, and monitor credential-leak feeds for your domain.
T1585 context Establish Accounts
Not performed by this site — shown for context only.
How this technique works: Social media, email, or code-hosting accounts are created to build a credible persona for later phishing or supply-chain attacks.
Remediation: Verify identities out-of-band before trusting unsolicited contact, even from seemingly established accounts.
T1566 context Phishing
Not performed by this site — shown for context only.
How this technique works: Malicious links or attachments are sent by email or chat to trick a user into executing code or entering credentials.
Remediation: Email filtering, DMARC enforcement, attachment sandboxing, and regular phishing-simulation training.
T1190 context Exploit Public-Facing Application
Not performed by this site — shown for context only.
How this technique works: A known or zero-day vulnerability in an internet-facing service — a web app, VPN gateway, etc. — is exploited directly.
Remediation: Timely patching, a web application firewall, and minimizing the internet-facing attack surface.
T1078 context Valid Accounts
Not performed by this site — shown for context only.
How this technique works: Legitimate credentials — stolen, purchased, or guessed — are used to log in as an authorized user.
Remediation: Enforce MFA everywhere, detect credential stuffing, and disable unused or default accounts.
T1133 context External Remote Services
Not performed by this site — shown for context only.
How this technique works: VPNs, RDP, or other externally-facing remote-access services are authenticated to directly.
Remediation: MFA on all remote-access services, and restrict exposure to only what's operationally necessary.
T1059 context Command and Scripting Interpreter
Not performed by this site — shown for context only.
How this technique works: Malicious commands are run via a shell or scripting interpreter — PowerShell, bash, Python — already present on the host.
Remediation: Constrained-language modes, script-block logging, and restricting interpreter access for standard users.
T1204 context User Execution
Not performed by this site — shown for context only.
How this technique works: The victim is convinced to open a malicious file or click a link that triggers execution.
Remediation: Application allow-listing and user training reduce the odds of an accidental execution.
T1203 context Exploitation for Client Execution
Not performed by this site — shown for context only.
How this technique works: A vulnerability in client software — a browser or document viewer — is exploited to run code when a file or page is opened.
Remediation: Keep client applications patched and use available browser/document sandboxing.
T1547 context Boot or Logon Autostart Execution
Not performed by this site — shown for context only.
How this technique works: Malicious code is registered to run automatically at boot or login — registry run keys, startup folders, and similar.
Remediation: Monitor autostart locations and use EDR to flag unexpected persistence entries.
T1053 context Scheduled Task/Job
Not performed by this site — shown for context only.
How this technique works: A scheduled task or cron job is created to re-launch malicious code at a set interval.
Remediation: Audit and alert on new or changed scheduled tasks, especially those running from unusual paths.
T1078 context Valid Accounts
Not performed by this site — shown for context only.
How this technique works: Access is maintained simply by continuing to use a compromised but legitimate account.
Remediation: Regular credential rotation and anomaly-based login monitoring.
T1082 context System Information Discovery
Not performed by this site — shown for context only.
How this technique works: Commands like systeminfo or uname -a enumerate OS version, architecture, and hardware.
Remediation: Restrict and alert on discovery-command execution via EDR; least-privilege accounts limit what's discoverable.
T1087 context Account Discovery
Not performed by this site — shown for context only.
How this technique works: Local or domain accounts are enumerated to find high-value targets or misconfigured permissions.
Remediation: Restrict directory-enumeration permissions and monitor for bulk account queries.
T1046 context Network Service Discovery
Not performed by this site — shown for context only.
How this technique works: Port and service scanning maps out what's reachable on the internal network.
Remediation: Network segmentation and IDS/IPS alerting on internal scan-like traffic patterns.
T1005 context Data from Local System
Not performed by this site — shown for context only.
How this technique works: Files of interest are gathered directly from the compromised host's disk.
Remediation: Encrypt sensitive data at rest and apply least-privilege file access.
T1114 context Email Collection
Not performed by this site — shown for context only.
How this technique works: Mailboxes are accessed directly, or exported mail-store files are harvested for sensitive correspondence.
Remediation: MFA on mailbox access and audit logging for mailbox exports and forwarding-rule changes.
T1113 context Screen Capture
Not performed by this site — shown for context only.
How this technique works: Periodic screenshots are taken to observe what the user is doing.
Remediation: Behavioral EDR detection for screen/clipboard-capture APIs invoked by unexpected processes.
T1071 context Application Layer Protocol
Not performed by this site — shown for context only.
How this technique works: C2 traffic is disguised as ordinary HTTP(S), DNS, or other common protocol traffic to blend in.
Remediation: TLS inspection where policy allows, plus anomaly-based network monitoring for beaconing patterns.
T1090 context Proxy
Not performed by this site — shown for context only.
How this technique works: Traffic is relayed through an intermediate proxy to obscure the true command-and-control endpoint.
Remediation: Threat-intel-based blocklists for known proxy and relay infrastructure.
T1573 context Encrypted Channel
Not performed by this site — shown for context only.
How this technique works: C2 communications are encrypted to prevent content inspection by network defenses.
Remediation: JA3/TLS fingerprinting and endpoint-based detection, since payload inspection alone won't catch this.
T1041 context Exfiltration Over C2 Channel
Not performed by this site — shown for context only.
How this technique works: Stolen data is sent out over the same channel already used for command and control.
Remediation: Egress filtering and DLP tuned to flag large or unusual outbound transfers.
T1567 context Exfiltration Over Web Service
Not performed by this site — shown for context only.
How this technique works: Data is uploaded to a legitimate cloud service — file share, paste site, chat webhook — to blend in with normal traffic.
Remediation: Restrict and monitor access to unsanctioned cloud services from corporate endpoints.
T1048 context Exfiltration Over Alternative Protocol
Not performed by this site — shown for context only.
How this technique works: Data leaves via a channel separate from the main C2 channel, such as DNS or FTP.
Remediation: Monitor and restrict outbound protocols to only what's operationally required.
T1486 context Data Encrypted for Impact
Not performed by this site — shown for context only.
How this technique works: Files are encrypted en masse — ransomware — to extort the victim for a decryption key.
Remediation: Immutable, offline backups and a tested restore process are the primary defense.
T1485 context Data Destruction
Not performed by this site — shown for context only.
How this technique works: Files or systems are wiped or corrupted to cause direct operational damage.
Remediation: Offline/immutable backups and strict write-access controls on critical data stores.
T1499 context Endpoint Denial of Service
Not performed by this site — shown for context only.
How this technique works: A service is flooded or resource-exhausted to make it unavailable to legitimate users.
Remediation: Rate limiting, autoscaling, and an upstream DDoS-mitigation or CDN service.
head -c 512 /dev/request
The matrix above is what a server does deliberately. This is what arrives whether or not anyone asks for it — every one of these was in the request that fetched this page, before a single line of JavaScript ran.
| Languages | not sent | Sent on every request. The order is a preference ranking, and a list that disagrees with the country your address maps to is a common sign of a VPN. |
| Client hints | not sent (browser doesn't support them) | Sec-CH-UA. Structured, and harder to spoof casually than the User-Agent string above. |
| Tracking preference | no preference sent | DNT / Sec-GPC. Neither is enforced by anything; sites are free to ignore them, and most do. Nothing here is logged. |
| Came from | typed, bookmarked or hidden | The Referer header names the page that linked here — including, on many sites, the search you ran to find it. |
| Compression offered | gzip, br, zstd, deflate | Which algorithms the browser understands. Brotli and zstd support narrow down how recent it is. |
| HTTP version | HTTP/1.0 | Negotiated with the web server before any content was sent. |
| TLS | not exposed by the proxy | The protocol version and cipher suite this connection agreed on. |
| Visits | first visit from this address | Counted from the log this site already keeps for 30 days, by address rather than by the fingerprint below — so it resets when your address changes, and a VPN makes you new again. The fingerprint would not have reset. |
navigator.*
And this is the active half: what the page can ask your browser directly. None of it is sent back to this server, none of it is stored, and no cookie is involved — it is read and rendered in your own browser. Reload with JavaScript disabled and the table below stays empty, while everything above it does not.
What that combination says
Fingerprint of 0 signals:
calculating…
Stable across visits, derived entirely from the values above, and arrived at without storing anything on your device. That is the mechanism behind tracking that survives clearing your cookies. This page computes it to make the point and then discards it.
A note on this data: the fields above are read from your browser's request headers (browser, OS, reverse DNS) and from a third-party IP-geolocation lookup performed by this server on your IP address (location, ISP/ASN, proxy/hosting flags) — this is the only outbound request this site ever makes on your behalf, and it happens server-side, never from your browser. Results are logged locally on this server for the site owner's own review only, are automatically deleted after 30 days, and are never shared with, sold to, or forwarded to any other third party. No cookies or persistent tracking are used. The two sections above them behave differently on purpose: the request-header table is server-side and its contents were already in this site's log, whereas everything read from your browser by JavaScript — including the fingerprint — stays in your browser and is never transmitted back, stored, or logged.