Report - atm4d2.online/

Report Overview

Submitted URL
atm4d2.online/
IP
172.67.181.102
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 07:38:36
Access
public
Website Title
JACKPOT AUTO KAYA DAFTAR DAN GABUNG DI ATM4D2 TARUHAN TERPERCAYA MUANTAB
Final URL
128.199.184.99/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
60

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
atm4d2.online	unknown	unknown	No data	No data	468 B	827 B	104.21.67.218
cdn.ampproject.org	329	2015-08-31	2015-10-09	2024-04-25	2.2 kB	113 kB	142.250.74.65
use.fontawesome.com	942	2012-10-18	2017-01-30	2024-04-24	956 B	110 kB	172.67.142.245
128.199.184.99	unknown	unknown	2017-02-10	2022-10-20	13 kB	3.5 MB	128.199.184.99

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed
2024-04-26	medium	128.199.184.99	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	cdn.ampproject.org/v0.js	285 kB	2024-04-24	2024-04-30
Pretty URL cdn.ampproject.org/v0.js IP 142.250.74.65 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 20:44:27 Last Seen2024-04-30 21:05:30 Times Seen50 Hash 93b22676750227c6081037abf8baa351 d3c33bea647267cd0fef7c24d1431c40409b74b5 53da1339a0555a71431c0bbfb2bf946f300ee9d5fc2e5b9e0b424c93a2506a82 Loading...

	cdn.ampproject.org/v0/amp-form-0.1.js	51 kB	2024-04-25	2024-04-30
Pretty URL cdn.ampproject.org/v0/amp-form-0.1.js IP 142.250.74.65 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-25 00:13:20 Last Seen2024-04-30 21:05:30 Times Seen10 Hash 4b97053d29f0a226b10630d96976cda9 e50d99f428f319cd74256360290f126035c9e6ec 6c7640e8e81f3cce965b863d94f3da33e3cb0540cde7f06d52bfddad301cbbf2 Loading...

	cdn.ampproject.org/v0/amp-sidebar-0.1.js	31 kB	2024-04-25	2024-04-30
Pretty URL cdn.ampproject.org/v0/amp-sidebar-0.1.js IP 142.250.74.65 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-25 00:13:20 Last Seen2024-04-30 21:05:30 Times Seen23 Hash faa6d28df6d92df3e3a283cb48ad06f8 d156ad9927ed90c0a4e10d24201b1d221495f848 a8aa12f4db04964e0ebcc49a4fc965e0002d7a214fe2745c5c7ea88e5f4e7148 Loading...

	cdn.ampproject.org/rtv/012404091947000/v0/amp-loader-0.1.js	13 kB	2024-04-24	2024-04-30
Pretty URL cdn.ampproject.org/rtv/012404091947000/v0/amp-loader-0.1.js IP 142.250.74.65 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 20:44:27 Last Seen2024-04-30 21:05:30 Times Seen39 Hash c62cd4c81f0172d7ac84d15281d3fa09 8a966261eaadac311a2d6ae4f32942883911ec01 1f5211c3d83be6fa51f5b9face5beda901221f2a6cf261acb3bbf47d89594126 Loading...

	cdn.ampproject.org/rtv/012404091947000/v0/amp-auto-lightbox-0.1.js	7.8 kB	2024-04-24	2024-04-30
Pretty URL cdn.ampproject.org/rtv/012404091947000/v0/amp-auto-lightbox-0.1.js IP 142.250.74.65 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 20:44:27 Last Seen2024-04-30 21:05:30 Times Seen41 Hash bd778223dafaed0894e021593ad5dcbf ef1a45e18a85060334571cdc9eaf1e9435b5ffe9 2b753b9c13fe907246062aa577f7837fbd2ffebe71dec501c4cd6de494016ac8 Loading...

HTTP Transactions (38)

URL IP Response Size

atm4d2.online/

104.21.67.218

301 Moved Permanently

167 B

URL User Request GET HTTP/2
atm4d2.online/
IP
104.21.67.218:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectatm4d2.online
FingerprintF3:8F:FE:5B:F0:E6:4B:2F:B3:EA:0F:3B:79:E2:E4:09:20:9F:82:B3
ValiditySun, 24 Mar 2024 04:32:49 GMT - Sat, 22 Jun 2024 04:32:48 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
167 B (167 bytes)
Hash
0104c301c5e02bd6148b8703d19b3a73
7436e0b4b1f8c222c38069890b75fa2baf9ca620
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

HTTP Headers

GET / HTTP/1.1
Host: atm4d2.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Fri, 26 Apr 2024 07:38:08 GMT
content-type: text/html
content-length: 167
location: https://128.199.184.99
cache-control: max-age=3600
expires: Fri, 26 Apr 2024 08:38:08 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1Z4AvxtGaj9oQ4LyoodUDcjZfLyptFcLyF5XT2GT%2BV%2BxWIENeb8lHMQLgd627Vzm0CuGornHzo4tJVPE4aXZEA5qVcYfRdfmUBH3dQWVRYsIF541yq2z%2BHS9PltF%2BmR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a4e959ae0856aa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdn.ampproject.org/v0/amp-form-0.1.js

142.250.74.65

200 OK

15 kB

URL GET HTTP/2
cdn.ampproject.org/v0/amp-form-0.1.js
IP
142.250.74.65:443
ASN
#15169 GOOGLE

Requested by
https://128.199.184.99/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
Fingerprint13:C7:40:78:3B:C5:3E:4C:BF:6E:15:DC:37:54:F1:48:24:A2:83:80
ValidityMon, 08 Apr 2024 06:40:27 GMT - Mon, 01 Jul 2024 06:40:26 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (50824)
Size
15 kB (14995 bytes)
Hash
4b97053d29f0a226b10630d96976cda9
e50d99f428f319cd74256360290f126035c9e6ec
6c7640e8e81f3cce965b863d94f3da33e3cb0540cde7f06d52bfddad301cbbf2

HTTP Headers

GET /v0/amp-form-0.1.js HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 14995
date: Fri, 26 Apr 2024 07:38:10 GMT
expires: Fri, 26 Apr 2024 07:38:10 GMT
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "0879e152b38110cf"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

cdn.ampproject.org/v0.js

142.250.74.65

200 OK

73 kB

URL GET HTTP/2
cdn.ampproject.org/v0.js
IP
142.250.74.65:443
ASN
#15169 GOOGLE

Requested by
https://128.199.184.99/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
Fingerprint13:C7:40:78:3B:C5:3E:4C:BF:6E:15:DC:37:54:F1:48:24:A2:83:80
ValidityMon, 08 Apr 2024 06:40:27 GMT - Mon, 01 Jul 2024 06:40:26 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (64654)
Size
73 kB (73093 bytes)
Hash
93b22676750227c6081037abf8baa351
d3c33bea647267cd0fef7c24d1431c40409b74b5
53da1339a0555a71431c0bbfb2bf946f300ee9d5fc2e5b9e0b424c93a2506a82

HTTP Headers

GET /v0.js HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 73093
date: Fri, 26 Apr 2024 07:38:10 GMT
expires: Fri, 26 Apr 2024 07:38:10 GMT
cache-control: private, max-age=3000, stale-while-revalidate=1206600
etag: "224c86d2f329f14e"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

cdn.ampproject.org/v0/amp-sidebar-0.1.js

142.250.74.65

200 OK

9.6 kB

URL GET HTTP/2
cdn.ampproject.org/v0/amp-sidebar-0.1.js
IP
142.250.74.65:443
ASN
#15169 GOOGLE

Requested by
https://128.199.184.99/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
Fingerprint13:C7:40:78:3B:C5:3E:4C:BF:6E:15:DC:37:54:F1:48:24:A2:83:80
ValidityMon, 08 Apr 2024 06:40:27 GMT - Mon, 01 Jul 2024 06:40:26 GMT

File type
JavaScript source, ASCII text, with very long lines (31247)
Size
9.6 kB (9646 bytes)
Hash
faa6d28df6d92df3e3a283cb48ad06f8
d156ad9927ed90c0a4e10d24201b1d221495f848
a8aa12f4db04964e0ebcc49a4fc965e0002d7a214fe2745c5c7ea88e5f4e7148

HTTP Headers

GET /v0/amp-sidebar-0.1.js HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: br
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 9646
date: Fri, 26 Apr 2024 07:38:10 GMT
expires: Fri, 26 Apr 2024 07:38:10 GMT
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "0e86908e1c35cf48"
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

cdn.ampproject.org/rtv/012404091947000/v0/amp-loader-0.1.js

142.250.74.65

200 OK

3.9 kB

URL GET HTTP/3
cdn.ampproject.org/rtv/012404091947000/v0/amp-loader-0.1.js
IP
142.250.74.65:443
ASN
#15169 GOOGLE

Requested by
https://128.199.184.99/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
Fingerprint13:C7:40:78:3B:C5:3E:4C:BF:6E:15:DC:37:54:F1:48:24:A2:83:80
ValidityMon, 08 Apr 2024 06:40:27 GMT - Mon, 01 Jul 2024 06:40:26 GMT

File type
JavaScript source, ASCII text, with very long lines (12614)
Size
3.9 kB (3935 bytes)
Hash
c62cd4c81f0172d7ac84d15281d3fa09
8a966261eaadac311a2d6ae4f32942883911ec01
1f5211c3d83be6fa51f5b9face5beda901221f2a6cf261acb3bbf47d89594126

HTTP Headers

GET /rtv/012404091947000/v0/amp-loader-0.1.js HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://128.199.184.99
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 3935
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:52:41 GMT
expires: Sat, 26 Apr 2025 05:52:41 GMT
cache-control: public, max-age=31536000
etag: "14ee94e1b9693284"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 6330
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

cdn.ampproject.org/rtv/012404091947000/v0/amp-auto-lightbox-0.1.js

142.250.74.65

200 OK

3.0 kB

URL GET HTTP/3
cdn.ampproject.org/rtv/012404091947000/v0/amp-auto-lightbox-0.1.js
IP
142.250.74.65:443
ASN
#15169 GOOGLE

Requested by
https://128.199.184.99/
Certificate
IssuerGoogle Trust Services LLC
Subjectmisc-sni.google.com
Fingerprint13:C7:40:78:3B:C5:3E:4C:BF:6E:15:DC:37:54:F1:48:24:A2:83:80
ValidityMon, 08 Apr 2024 06:40:27 GMT - Mon, 01 Jul 2024 06:40:26 GMT

File type
JavaScript source, ASCII text, with very long lines (7690)
Size
3.0 kB (2974 bytes)
Hash
bd778223dafaed0894e021593ad5dcbf
ef1a45e18a85060334571cdc9eaf1e9435b5ffe9
2b753b9c13fe907246062aa577f7837fbd2ffebe71dec501c4cd6de494016ac8

HTTP Headers

GET /rtv/012404091947000/v0/amp-auto-lightbox-0.1.js HTTP/1.1
Host: cdn.ampproject.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://128.199.184.99
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: br
access-control-allow-origin: *
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
timing-allow-origin: *
content-length: 2974
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:01:18 GMT
expires: Sat, 26 Apr 2025 06:01:18 GMT
cache-control: public, max-age=31536000
etag: "dfcaaf971da6dba2"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 5813
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

use.fontawesome.com/releases/v5.8.1/webfonts/fa-solid-900.woff2

172.67.142.245

200 OK

74 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.8.1/webfonts/fa-solid-900.woff2
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://128.199.184.99/
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 74256, version 329.-17761
Size
74 kB (74256 bytes)
Hash
418dad87601f9c8abd0e5798c0dc1feb
a6b003ef506e92d05cde73adf67487d7fd7ec6df
f18c486a80175cf02fee0e05c2b4acd86c04cdbaecec61c1ef91f920509b5efe

HTTP Headers

GET /releases/v5.8.1/webfonts/fa-solid-900.woff2 HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://128.199.184.99
DNT: 1
Connection: keep-alive
Referer: https://use.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 07:38:11 GMT
content-type: font/woff2
content-length: 74256
access-control-allow-origin: *
cache-control: max-age=31556926
etag: "418dad87601f9c8abd0e5798c0dc1feb"
last-modified: Fri, 22 Sep 2023 01:45:57 GMT
vary: Origin, Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZTRtUh6puaQJViv1P%2BHbwgGWsllVM4%2FLrsEZxFma00UM4gWXQu6GLUVuX5izkwlrXEsu1MJalFO4thr0PwpR3opQKks9EWw%2F%2F6Tv1f7jm3K6Mxkanxgm1Vl4p8DZnnv8tubumH%2BU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a4e96e0bcfb51b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

128.199.184.99/img/background.pngATAS

128.199.184.99

404 Not Found

146 B

URL GET HTTP/2
128.199.184.99/img/background.pngATAS
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
146 B (146 bytes)
Hash
8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/background.pngATAS HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
server: nginx
date: Fri, 26 Apr 2024 07:38:12 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2

128.199.184.99/img/atm4d2-logo.png

128.199.184.99

200 OK

101 kB

URL GET HTTP/2
128.199.184.99/img/atm4d2-logo.png
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 400 x 160, 8-bit/color RGBA, non-interlaced
Size
101 kB (101325 bytes)
Hash
2ffdd12aec34e9ae35ba3cc9f61614c1
d1b343287910781d0bd2a6ea20d582d0a092a0c9
0e612597dd1de1d6e3bc7cb62785be2efd0ca804911ca6cb57c0152b4c6d9701

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/atm4d2-logo.png HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:12 GMT
content-type: image/png
content-length: 101325
last-modified: Tue, 26 Dec 2023 00:55:43 GMT
etag: "658a248f-18bcd"
expires: Sun, 26 May 2024 07:38:12 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/mahjong-ways-2.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/mahjong-ways-2.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
27 kB (26833 bytes)
Hash
2f6a1257bb1380a8df5af66697c53a4e
193c242f20348b3e7cfb2f98ef184dbc08e0b553
c2be287fe359b7dbd843da2ca0fc2c2422311d6ca9a266ea5f3ccc2cd781ed3f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/mahjong-ways-2.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 26833
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-68d1"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/mahjong-ways.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/mahjong-ways.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
27 kB (26765 bytes)
Hash
5f56645bcf63b3c0d6f6056a63318eb0
36a9d5d2fad7501ff0d3c59c0093d223cb6bb825
58eee0a22921b83eb6578d3d6656827bdcfe7413460654f6a7cb80cfcd0d9dd2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/mahjong-ways.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 26765
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-688d"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/gates-of-olympus.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/gates-of-olympus.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
27 kB (27077 bytes)
Hash
bf4d5f08c00ebc644f9c94492e198156
345b0c66e091cc4114924387f62fd7b510b346b3
6f6579ca7acfcc4979439d5a20fb74367715e112f0460c6253f8f8df2d480fee

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/gates-of-olympus.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 27077
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-69c5"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/lucky-neko.webp

128.199.184.99

200 OK

25 kB

URL GET HTTP/2
128.199.184.99/img/lucky-neko.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
25 kB (24778 bytes)
Hash
10003b14b06d9711de6c2a416b2ee895
3ce296531c4bfee1cc2d86022b820969a32c0d6c
928cebaddbcedefd23f92d83b68389be8b21c9b5f0cacca30a1474e15d3d376a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/lucky-neko.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 24778
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-60ca"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/sw-eet-bonanza.webp

128.199.184.99

200 OK

24 kB

URL GET HTTP/2
128.199.184.99/img/sw-eet-bonanza.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
24 kB (23753 bytes)
Hash
e3dd565900b4f27cd7039fefe73466b3
0e1c51836d8a1cc84652f481255afb497f89030e
a4c5839ddb7da670315de6ba5defd73649b992d79cf6fec981159f934f7413d8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/sw-eet-bonanza.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 23753
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5cc9"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/

128.199.184.99

200 OK

51 kB

URL User Request GET HTTP/2
128.199.184.99/
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
gzip compressed data, from Unix
Size
51 kB (51205 bytes)
Hash
0ede6c7b1c39de573950a30c55ec29c9
fd64ae13e26769d10884d1afe081910cfbf2f774
905f032c2bf0dbf7fce29354a385c2c54f1328139bda1ae5992c2352ea27a0dd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:10 GMT
content-type: text/html
last-modified: Mon, 05 Feb 2024 08:27:24 GMT
vary: Accept-Encoding
etag: W/"65c09bec-17ae7"
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2

128.199.184.99/img/treasures-of-aztec.webp

128.199.184.99

200 OK

25 kB

URL GET HTTP/2
128.199.184.99/img/treasures-of-aztec.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
25 kB (24677 bytes)
Hash
6de276a509f1c1bcc47e8323c3e7e779
4dc6790ed30d235d4ccebc070fdb64b2e69c489c
76bfd6e58ff81b4e8b84b15ef523a38dbb97bdc2e431d6696b3429250a39c914

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/treasures-of-aztec.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 24677
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-6065"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/sugar-rush.webp

128.199.184.99

200 OK

22 kB

URL GET HTTP/2
128.199.184.99/img/sugar-rush.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
22 kB (22288 bytes)
Hash
fb4a9ab13d23156850f5267b947d03c0
2e369963c8c6f96f8156f811d594874fc020ca0d
2eb592b85d14d0fd45efa485ea3acb6443c891f1a164c57122d5180935575d99

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/sugar-rush.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 22288
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5710"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

use.fontawesome.com/releases/v5.8.1/css/all.css

172.67.142.245

200 OK

35 kB

URL GET HTTP/2
use.fontawesome.com/releases/v5.8.1/css/all.css
IP
172.67.142.245:443
ASN
#13335 CLOUDFLARENET

Requested by
https://128.199.184.99/
Certificate
IssuerCloudflare, Inc.
Subjectuse.fontawesome.com
FingerprintCB:BE:6B:C4:5F:DF:18:7A:C3:AD:BF:6C:40:36:18:9F:E2:99:7F:78
ValidityThu, 12 Oct 2023 00:00:00 GMT - Thu, 10 Oct 2024 23:59:59 GMT

File type
ASCII text, with very long lines (54926)
Size
35 kB (34717 bytes)
Hash
e4c542a7f6bf6f74fdd8cdf6e8096396
3a0571a695a35f238026b9398386dc99d9a0c56d
eeb17a45a48aca1d7adbcf04de155dcd0b47cb36ad036310446bb471fea9aaa3

HTTP Headers

GET /releases/v5.8.1/css/all.css HTTP/1.1
Host: use.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 07:38:10 GMT
content-type: text/css
cache-control: max-age=31556926
etag: W/"e4c542a7f6bf6f74fdd8cdf6e8096396"
last-modified: Fri, 22 Sep 2023 01:45:55 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2594164
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpbSDud%2F4nPLwBCNt2gECk59aI6Johy0C5XzpN3dzz1eSZGc%2F%2FN2ea7tTOw1vQOHZ27eQpMgRcMjKL3hBNkJY3Z3a0OGotfOQ2oXbDmCyyhGiOP3g59%2F%2FL0r9ur29hO1XxwWmN26"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a4e9697cf5b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

128.199.184.99/img/wild-bounty-showdown.webp

128.199.184.99

200 OK

23 kB

URL GET HTTP/2
128.199.184.99/img/wild-bounty-showdown.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 339x200, components 3
Size
23 kB (22954 bytes)
Hash
ca3914176ccea450750ed36a24d1a7a6
07e028ab0bd5698f438bb08493ad9429614eaafa
7374633541ea2673e904f3d34b2482dd2621f1cd2304ff08494e0e01c9b86e4c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/wild-bounty-showdown.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 22954
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-59aa"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/spaceman.webp

128.199.184.99

200 OK

20 kB

URL GET HTTP/2
128.199.184.99/img/spaceman.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
20 kB (19569 bytes)
Hash
5c6c0773b04726c98bb876d1fd2e3acc
ad116d737a6d3ff68d941b7b0ff3cfbc15355f6c
9a39a92ce01fe5f11a7b8a1421cc7667aaaab88175ffaa1a5a7fe7aebe431597

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/spaceman.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 19569
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-4c71"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/sugar-bonanza.webp

128.199.184.99

200 OK

17 kB

URL GET HTTP/2
128.199.184.99/img/sugar-bonanza.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, progressive, precision 8, 339x200, components 3
Size
17 kB (17415 bytes)
Hash
6ba90180d6d452b6eba0c89ad09f2934
a8e263d52a1ce4062b51e6513e46477a5ca29635
fda52036ff3026877ccc66041fcfa795d2eea1f66b98a80e519f8d7b9e41ea1c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/sugar-bonanza.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 17415
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-4407"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/sw-ord-of-ares.webp

128.199.184.99

200 OK

22 kB

URL GET HTTP/2
128.199.184.99/img/sw-ord-of-ares.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
22 kB (21813 bytes)
Hash
2572799730cc1d34fcf95a810796f327
2f55d6468313b01bf4adf0c44fdd813a4886cf6a
9df0588477f2513480694b6b83260a02ac45f8c9e590ed8af47e503f526f84aa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/sw-ord-of-ares.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 21813
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5535"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/caishen-wins.webp

128.199.184.99

200 OK

34 kB

URL GET HTTP/2
128.199.184.99/img/caishen-wins.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
34 kB (34398 bytes)
Hash
9dce65869e233578c22d5f7c12bd4613
a3e5dabac9588f1020c2e6e43410158a08af46c5
2725dbc544aad6a5c8eaf6b3d2054dd8e068fda65a61ba045a82eb973096f7ba

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/caishen-wins.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 34398
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-865e"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/ways-of-the-qilin.webp

128.199.184.99

200 OK

15 kB

URL GET HTTP/2
128.199.184.99/img/ways-of-the-qilin.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, progressive, precision 8, 339x200, components 3
Size
15 kB (15094 bytes)
Hash
bbb7bcb1303fb9fe0eddc130dddf2141
2b1340f0af75552d5aced9c881983deb3311c1f7
7bb110ac1be95bb30dff30b39726709323b1adf9bb219b774608920f97c37c3e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/ways-of-the-qilin.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 15094
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-3af6"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/sw-eet-bonanza-xmas.webp

128.199.184.99

200 OK

28 kB

URL GET HTTP/2
128.199.184.99/img/sw-eet-bonanza-xmas.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
28 kB (28183 bytes)
Hash
038fb01d0e299e2d544eba41f6f11de7
94c56966130ca67273e46d3e48b97c96ac179204
9fff31e66909df9e9717ecc71edc2d597fd82f6e3db02931d7a3d138282cb285

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/sw-eet-bonanza-xmas.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 28183
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-6e17"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/gates-of-gatotkaca.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/gates-of-gatotkaca.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 339x200, components 3
Size
27 kB (27290 bytes)
Hash
4f274a4f96524841e4d538cf8ede413b
0e5b4d279f74d24e34592223a25bb1529ebb302c
3c1187a70c1010c41fc3a645d8dfaa7b204ad8f57234368e6c72ef354f2ccfa9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/gates-of-gatotkaca.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 27290
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-6a9a"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/koi-gate.webp

128.199.184.99

200 OK

30 kB

URL GET HTTP/2
128.199.184.99/img/koi-gate.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
30 kB (30472 bytes)
Hash
3cf9bee97cb0e62ace0dee6ed6bd45d2
f983c1cc309bed5be63f8dfda8f4d421471382df
83b5ac2dd2135484b39c82450e5f290c55d33bcd257668484b669d9944e801ea

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/koi-gate.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 30472
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-7708"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/wanbao-dino.webp

128.199.184.99

200 OK

22 kB

URL GET HTTP/2
128.199.184.99/img/wanbao-dino.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
22 kB (22030 bytes)
Hash
aeb1a6bab61759a81dd10dd73942a0de
0250cd88c12011ad07a224a8265355a80c6fb33b
da7d77354e07a2b3c8856d1ca9b4abc5e73d8cfad739d87c4484acae8e887687

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/wanbao-dino.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 22030
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-560e"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/dragon-hatch.webp

128.199.184.99

200 OK

24 kB

URL GET HTTP/2
128.199.184.99/img/dragon-hatch.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, progressive, precision 8, 339x200, components 3
Size
24 kB (23730 bytes)
Hash
4526ead6bc9f6f5e6baf4fdc1c0cf5b3
03def8f603d238f4deaab03ed8572b66ca77365d
e57eb6e4e532292728fc46c58693dd15eb53789315cf910d44b91751aa657703

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/dragon-hatch.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 23730
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5cb2"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/rooster-rumble.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/rooster-rumble.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
27 kB (26820 bytes)
Hash
b5f154e1db3c1f32d64a9aea77e19c9d
6c509a99917359753e12aa6b35be8b5005aac62e
dadf17cd9cf2f902c7850b58d93c8fb82b45a1b7b5d288a42c5d84ab9306f312

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/rooster-rumble.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 26820
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-68c4"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/wild-west-gold.webp

128.199.184.99

200 OK

27 kB

URL GET HTTP/2
128.199.184.99/img/wild-west-gold.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
27 kB (26802 bytes)
Hash
3c123e8f5b3fd92df96e9878d264aae5
8992ffea9335f5ea3275360ed86f8a692189e9af
f2e8934896f9c43ff7abeef3148f2d959f5eb5b8237983f4e07850dcc9b2e176

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/wild-west-gold.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 26802
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-68b2"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/dreams-of-macau.webp

128.199.184.99

200 OK

21 kB

URL GET HTTP/2
128.199.184.99/img/dreams-of-macau.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
21 kB (20822 bytes)
Hash
d4864d6a0b5df94ea2309c3dcf48ea45
88cb0a11045d4f622955bd744d6b34c57013fa0f
24383e1fe74da5a079755cef3f076ffb6e9ac479a68185a32a4de7aa22ee2ee8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/dreams-of-macau.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 20822
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5156"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/ganesha-fortune.webp

128.199.184.99

200 OK

26 kB

URL GET HTTP/2
128.199.184.99/img/ganesha-fortune.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
26 kB (25635 bytes)
Hash
e5063420c8a42be074c8264af221e88e
d326a70913bdf06bdf7725b3d496f99e964742ee
9713767822451a20b19178192f784249cf86edf9db6544f1d605e19bd57635ed

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/ganesha-fortune.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 25635
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-6423"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/background.png

128.199.184.99

200 OK

2.5 MB

URL GET HTTP/2
128.199.184.99/img/background.png
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 1279 x 718, 8-bit/color RGBA, non-interlaced
Size
2.5 MB (2537804 bytes)
Hash
977f667efb66c6851f6ba996285a4b19
9fdb81ce429672742b0f8c01119b490d1859106c
f20c12107e741a681805929093a80c28188a03945308f1a4f2c96f2e64261c3e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/background.png HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:12 GMT
content-type: image/png
content-length: 2537804
last-modified: Tue, 26 Dec 2023 00:55:43 GMT
etag: "658a248f-26b94c"
expires: Sun, 26 May 2024 07:38:12 GMT
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/icon-atm4d2.webp

128.199.184.99

200 OK

120 kB

URL GET HTTP/2
128.199.184.99/img/icon-atm4d2.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
ISO Media, AVIF Image
Size
120 kB (119942 bytes)
Hash
a7d768e97131e184754c10af4cb2852f
9b908861ca963cd6e77b61f3e95105bc02274643
fc5ce4e82ceb9ab4584dda3688b0997a40533cb811e6b9a3ac9cd41f14627486

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/icon-atm4d2.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:14 GMT
content-type: image/webp
content-length: 119942
last-modified: Tue, 26 Dec 2023 00:55:43 GMT
etag: "658a248f-1d486"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/icon-atm4d2.webp

128.199.184.99

200 OK

120 kB

URL GET HTTP/2
128.199.184.99/img/icon-atm4d2.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
ISO Media, AVIF Image
Size
120 kB (119942 bytes)
Hash
a7d768e97131e184754c10af4cb2852f
9b908861ca963cd6e77b61f3e95105bc02274643
fc5ce4e82ceb9ab4584dda3688b0997a40533cb811e6b9a3ac9cd41f14627486

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/icon-atm4d2.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:14 GMT
content-type: image/webp
content-length: 119942
last-modified: Tue, 26 Dec 2023 00:55:43 GMT
etag: "658a248f-1d486"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/starlight-princess.webp

128.199.184.99

200 OK

31 kB

URL GET HTTP/2
128.199.184.99/img/starlight-princess.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 339x200, components 3
Size
31 kB (31139 bytes)
Hash
a8a7db76ca552b74ab67b814b085a671
dc410bef9ee5cf0de82a4af248db19a63c2d0c20
69ba1fc87bf87c8e6a58f7861e89b092df05656c7ca463903ed8ce8100df6206

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/starlight-princess.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 31139
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-79a3"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

128.199.184.99/img/wild-bandito.webp

128.199.184.99

200 OK

23 kB

URL GET HTTP/2
128.199.184.99/img/wild-bandito.webp
IP
128.199.184.99:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
https://128.199.184.99/
Certificate
IssuerZeroSSL
Subject128.199.184.99
FingerprintA9:A6:10:8B:D9:54:3E:87:6C:30:62:61:70:E4:0A:AE:53:9C:30:81
ValidityThu, 22 Feb 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
JPEG image data, progressive, precision 8, 339x200, components 3
Size
23 kB (22658 bytes)
Hash
83e1207a5ec6d51650735eb6575fee69
ee0be51dfb29ad0cb6740973ce6cc0aa70e8ec22
3112b0cd5ce438f4aa99a813dd49bc70294e6e4b3ffd61ce0409533c32eba0aa

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /img/wild-bandito.webp HTTP/1.1
Host: 128.199.184.99
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://128.199.184.99/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 07:38:13 GMT
content-type: image/webp
content-length: 22658
last-modified: Tue, 26 Dec 2023 00:55:42 GMT
etag: "658a248e-5882"
strict-transport-security: max-age=31536000
accept-ranges: bytes
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (38)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2