| kotmxar.cc/invite | 104.21.55.142 | 200 OK | 0 B |
IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /invite HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 20
Origin: https://kotmxar.cc
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:45 GMT
content-length: 0
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8KTmT8Hkmx6hA60fRimFVWOwtdbkU8FniwXtzS3AX2lryU3dIFQOC%2Fmw2Xr7U1SfpkI%2BTOWXl%2FdmW6MM01DwXfDfrdIlXrW09%2BOvt7uUQiFg2ygbiM0GkW4iRluE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff5d099c2356ab-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdn.discordapp.com/attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& | 162.159.134.233 | | 36 B |
URL cdn.discordapp.com/attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& IP162.159.134.233:0
File typeASCII text, with no line terminators Hasha1ca4bebcd03fafbe2b06a46a694e29a ffc88125007c23ff6711147a12f9bba9c3d197ed c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
GET /attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Tue, 07 May 2024 07:05:45 GMT
content-type: text/plain;charset=UTF-8
content-length: 36
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z9DFWJwjJ6pgx0rxn7g2OKnq7%2FNaeyOfIGz2wCefRfQrlRiKudZ41lOlPDBv5ZmWUYlEr%2FOULmruwjD6QokxJ4ndFhfRh8cvAn6cZvTULcD%2Ba%2Fx4%2F1RXiQuRarl%2Fb8snnEvtvw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
set-cookie: __cf_bm=ubJx8AMDrr.bJ6_WOpgSxrzav2AAXGJC_4mlDUyCswo-1715065545-1.0.1.1-99qQMVgttTPPu1Wa98kqwX1Hk6k5KTaQRWknFUZVjbUGxR5DfPlW1YzNFy.XrYW79uoYGG0N8fkkNTh_WCHjVg; path=/; expires=Tue, 07-May-24 07:35:45 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=rBDIqLdANHHMq59o1fcyNMnOR5ZqT1AGppEg.wF8rvo-1715065545466-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 87ff5d0b19b756a2-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| kotmxar.cc/socket.io/?EIO=3&transport=websocket | 104.21.55.142 | | 0 B |
URL kotmxar.cc/socket.io/?EIO=3&transport=websocket IP104.21.55.142:0
CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=websocket HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://kotmxar.cc
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: hZ8MmFgg2pdxMsV9n7dCCQ==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: inviteNumber=-1; username=; hasLogin=false; tier=-1; password=; userId=-1; hasGuide=false
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Date: Tue, 07 May 2024 07:05:45 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bqvGCKz9qDoszJm6IlRttn5ojNs=
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXOng1TjRi8Er%2FeflHDwLjMW5BLG9XcAUjMXt%2F7kDGF8oV6zUhoCuYKBkqw75D3IgtZl8%2Bz6ikQVMfBg%2F%2B5MQCf0LWhTWmjAufRZYbjOHo9NdKZ13yFQYX2f7%2Feg"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 87ff5d0ada9356c7-OSL
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/getlog | 104.21.55.142 | 200 OK | 5.2 kB |
IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Hash5587025c4136aec18829c72cbbdfd535 378ba712ec025d2fed9fdbf51c4b69cfe966aa28 a2becf081af0db1206b1ef4f56438b854e248e20cd670fd9038b7cd990e23d27
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /getlog HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/enter/register
Cookie: inviteNumber=-1; username=; hasLogin=false; tier=-1; password=; userId=-1; hasGuide=false
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:45 GMT
content-type: application/json; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kdvj2oIMjQ6iTwcO%2Bc91jYUT51hMYGkgIj0wPNMUmWQKrHlLp2JCn1JFE8XUBSpNBA5CYtAc%2BPuPsKunqSb0awDbicvgqS6%2F97Sbcumdm%2Bc%2Bz%2BG%2BcURQEzsGDfCi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff5d0aae0856ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/img/icons/favicon.svg | 104.21.55.142 | 200 OK | 1.4 kB |
URL GET HTTP/3kotmxar.cc/img/icons/favicon.svg IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
File typeHTML document, ASCII text, with very long lines (2703), with no line terminators Hash6d616a041b5d1533fde8c6414b3bffc0 420f3f52db3d8e9544cc7dd7f028f7b50af03cd1 7660d8b687387f9559cb67979ebdcee2f3a03896952a910b4fd1d9a6f4747ba0
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /img/icons/favicon.svg HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Cookie: inviteNumber=-1; username=; hasLogin=false; tier=-1; password=; userId=-1; hasGuide=false
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:45 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-cache-status: EXPIRED
last-modified: Tue, 07 May 2024 04:59:13 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LUuyveW5M1S0f1SfUFXTfBtN7ocS6ki22piemnSakwf7W4zE5cGSSL2uw4srt6%2F%2FQSdRA%2B9qt%2FvwTBuxlpwPmrg%2FRcjkCiiVGwbRyb7paQdawDHuoZm%2BZp26tge9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d0c485056ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| b.yzcdn.cn/vant/icon-demo-1126.png | 154.85.69.57 | 200 OK | 8.9 kB |
URL GET HTTP/2b.yzcdn.cn/vant/icon-demo-1126.png IP154.85.69.57:443 ASN#139057 LEGEND DYNASTY PTE. LTD.
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuersslTrus Subject*.yzcdn.cn Fingerprint6A:A8:BA:7C:D4:B4:86:0B:74:EB:E6:19:C8:69:2E:8B:13:6C:1E:1B ValidityThu, 09 Nov 2023 00:00:00 GMT - Mon, 09 Dec 2024 23:59:59 GMT
File typePNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced Hashf87c46f346a5548224ccbe0b6bd75df5 8e8b8bd4ba3e6b6c8557d94a726061fdd62492fd b6304eb9b754d38d3ad74d0acce42c156536840351368ed3e4895a6b50cd9370
GET /vant/icon-demo-1126.png HTTP/1.1
Host: b.yzcdn.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 07 May 2024 07:05:47 GMT
content-type: image/png
content-length: 8886
server: openresty
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: X-Log, X-Reqid
access-control-max-age: 2592000
cache-control: public, max-age=2592000
content-disposition: inline; filename="icon-demo-1126.png"; filename*=utf-8''icon-demo-1126.png
content-md5: +HxG80alVIIkzL4La9dd9Q==
content-transfer-encoding: binary
etag: "Fo6Li9S6PmtshVfZSnJgYf3WJJL9"
last-modified: Mon, 26 Nov 2018 11:08:05 GMT
x-reqid: YyIAAAASg9geDiAX
x-svr: IO
x-qiniu-zone: 0
x-log: X-Log
x-ser: BC5_dx-lt-yd-zhejiang-huzhou-3-cache-7, BC165_lt-obgp-fujian-xiamen-33-cache-1, BC132_IT-Lombardia-Milan-1-cache-1, BC46_DE-Frankfurt-Frankfurt-11-cache-4
x-cache: HIT from BC46_DE-Frankfurt-Frankfurt-11-cache-4(baishan)
X-Firefox-Spdy: h2
|
|
| kotmxar.cc/js/chunk-vendors.ea790e22.js | 104.21.55.142 | 200 OK | 949 kB |
URL GET HTTP/3kotmxar.cc/js/chunk-vendors.ea790e22.js IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Size949 kB (949174 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /js/chunk-vendors.ea790e22.js HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:44 GMT
content-type: text/javascript; charset=utf-8
last-modified: Mon, 06 May 2024 16:13:24 GMT
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zqb4IlGWiyJIosVjlLQsK%2FT%2BFoZdMRN1aljjGmSxtvcK3v0KccKGgPTriyiYu40DmefejAf7la3NL9OoZ%2FhRAguZ%2Bd8gm0eyu7My9wlZE6yqdQyRkUx2CXy1LHn3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d043c4b56ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/js/app.ac354765.js | 104.21.55.142 | 200 OK | 171 kB |
URL GET HTTP/3kotmxar.cc/js/app.ac354765.js IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Size171 kB (171138 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /js/app.ac354765.js HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:44 GMT
content-type: text/javascript; charset=utf-8
last-modified: Mon, 06 May 2024 16:13:17 GMT
cache-control: max-age=14400
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pQm3lPN2Cpdwpp00zVCPOKGpLkm6RbdwL%2FsJD%2FhAoP%2Fj0oX42Atgbhddz9Hv5EJ%2BBg9LQEqbs1oCTbrl7BWavbVnFpvE0kWSybraAysM%2Baz5UwjVSPcfNlT%2BB9GC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d043c4e56ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/css/app.2738a5cc.css | 104.21.55.142 | 200 OK | 14 kB |
URL GET HTTP/3kotmxar.cc/css/app.2738a5cc.css IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
File typeASCII text, with very long lines (14103), with no line terminators Hash4e8e74db0c30a94fdee617afc524f285 5383da0a5986d5556b9f212683690bcd79b05316 c66647042f7ec0356d83ca675982bb3db18b04217cf0dd2a121d0cf7e881e105
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /css/app.2738a5cc.css HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:44 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 06 May 2024 16:13:04 GMT
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o0pHO%2Fo55TGRmU373tngfYikxjBtH8JtT7jtzaucNYTvVHjHkJT%2BVn7034mXBNFVMdl0luLGzu5qEeMuURLlXbSFnb2AjAu4JSTrxGKX9ReA5XWFkjWa2Jx%2FErw6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d044c5556ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/socket.io/?EIO=3&transport=websocket | 104.21.55.142 | 101 Switching Protocols | 0 B |
URL GET HTTP/1.1kotmxar.cc/socket.io/?EIO=3&transport=websocket IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /socket.io/?EIO=3&transport=websocket HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://kotmxar.cc
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: hZ8MmFgg2pdxMsV9n7dCCQ==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: inviteNumber=-1; username=; hasLogin=false; tier=-1; password=; userId=-1; hasGuide=false
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Date: Tue, 07 May 2024 07:05:45 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: bqvGCKz9qDoszJm6IlRttn5ojNs=
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXOng1TjRi8Er%2FeflHDwLjMW5BLG9XcAUjMXt%2F7kDGF8oV6zUhoCuYKBkqw75D3IgtZl8%2Bz6ikQVMfBg%2F%2B5MQCf0LWhTWmjAufRZYbjOHo9NdKZ13yFQYX2f7%2Feg"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 87ff5d0ada9356c7-OSL
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/img/icons/apple-touch-icon-152x152.png | 104.21.55.142 | 200 OK | 4.0 kB |
URL GET HTTP/3kotmxar.cc/img/icons/apple-touch-icon-152x152.png IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
File typePNG image data, 152 x 152, 8-bit/color RGB, non-interlaced Hash1a034e64d80905128113e5272a5ab95e 92328e60f63d690f33cd4961b9934a539dc29b82 4d9685d610c4411caadd8d36ce94d3303cf5b05c8e04d67fc232c16a4469a135
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /img/icons/apple-touch-icon-152x152.png HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Cookie: inviteNumber=-1; username=; hasLogin=false; tier=-1; password=; userId=-1; hasGuide=false
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:45 GMT
content-type: image/png
content-length: 4046
last-modified: Mon, 06 May 2024 16:13:10 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 7028
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ifD9uNsTCeMj%2BLONYHCXwdJb9o3H262LiH6vaF2GU%2F%2BL%2Frx3YJA7tB%2B3QBrpYg2WpMMm3FwSQhy7kNeAiF6VM%2BcM%2BG4RrO2iSDVg9aO%2FJk4sC1%2FHent8gmUvrqE1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d0c484e56ab-OSL
alt-svc: h3=":443"; ma=86400
|
|
| kotmxar.cc/invite/i=34981 | 104.21.55.142 | 200 OK | 2.7 kB |
URL User Request GET HTTP/2kotmxar.cc/invite/i=34981 IP104.21.55.142:443
CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
File typeHTML document, ASCII text, with very long lines (2869), with no line terminators Hash2521b09007721bda6a40af172bff7f5d bcee85dae4aee9e37289212c490250b4322a311f a2500b64b8d25b8e79d485e0bf96731bbc9b26357a92bd89abef3fadcc369cbc
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /invite/i=34981 HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 07 May 2024 07:05:44 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h58yEfEJl%2Fbm9rWzCTzrm51ByOI9nh6%2B3UHQ5V3oP5cg43STZamyK%2BPfmaXFpVHyn8ceXH5bsBFkgfIg0U8nUQvxc4d8GOmCdLSeE7Rjqbh5x0%2BWbE3RKWRHrtJB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ff5d012d0e712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| kotmxar.cc/css/chunk-vendors.c57533e1.css | 104.21.55.142 | 200 OK | 156 kB |
URL GET HTTP/3kotmxar.cc/css/chunk-vendors.c57533e1.css IP104.21.55.142:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerGoogle Trust Services LLC Subjectkotmxar.cc Fingerprint67:2C:FE:41:05:93:6E:0D:A8:88:ED:AC:C3:3F:5F:EC:09:64:C5:13 ValiditySat, 04 May 2024 04:49:21 GMT - Fri, 02 Aug 2024 04:49:20 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size156 kB (156544 bytes) Hashebfffebc1f62c3be51082e6595a0a005 e278fbd6fd48150b3f366b50ed388983d934978c f5ce9e73e1f7cea326eedd4f39d9b2d703ba4ccb31a6078cdc1fb16481298a32
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /css/chunk-vendors.c57533e1.css HTTP/1.1
Host: kotmxar.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/invite/i=34981
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 07 May 2024 07:05:44 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 06 May 2024 16:13:05 GMT
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwOiHWXmIb4wyzEof40ZJzqiSkiccNAU6%2FbAXj1QawWglXzP6kvFCffKh3fR9E1NHc7nBFSvb0knY0tIkgYjDsIiW4snayLCIscqllvC8IGtgWkU2FXT45wVxP%2F%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ff5d043c5056ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cdn.discordapp.com/attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& | 162.159.134.233 | 404 Not Found | 0 B |
URL GET HTTP/2cdn.discordapp.com/attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& IP162.159.134.233:443
Requested byhttps://kotmxar.cc/invite/i=34981 CertificateIssuerCloudflare, Inc. Subjectdiscordapp.com Fingerprint97:8B:EE:AD:1E:BF:A1:69:E7:94:29:F7:55:7A:29:64:19:C7:81:39 ValidityFri, 20 Oct 2023 00:00:00 GMT - Sat, 19 Oct 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /attachments/1234841437133082708/1234841485380157440/dfbrtb8m.mp4?ex=66323340&is=6630e1c0&hm=cf4c9d797523ded5c647ed18c1f3b8e50a5560ac0a4f6adae673380eeee8e930& HTTP/1.1
Host: cdn.discordapp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://kotmxar.cc/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Tue, 07 May 2024 07:05:45 GMT
content-type: text/plain;charset=UTF-8
content-length: 36
x-robots-tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z9DFWJwjJ6pgx0rxn7g2OKnq7%2FNaeyOfIGz2wCefRfQrlRiKudZ41lOlPDBv5ZmWUYlEr%2FOULmruwjD6QokxJ4ndFhfRh8cvAn6cZvTULcD%2Ba%2Fx4%2F1RXiQuRarl%2Fb8snnEvtvw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
set-cookie: __cf_bm=ubJx8AMDrr.bJ6_WOpgSxrzav2AAXGJC_4mlDUyCswo-1715065545-1.0.1.1-99qQMVgttTPPu1Wa98kqwX1Hk6k5KTaQRWknFUZVjbUGxR5DfPlW1YzNFy.XrYW79uoYGG0N8fkkNTh_WCHjVg; path=/; expires=Tue, 07-May-24 07:35:45 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
_cfuvid=rBDIqLdANHHMq59o1fcyNMnOR5ZqT1AGppEg.wF8rvo-1715065545466-0.0.1.1-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 87ff5d0b19b756a2-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|