| www.googletagmanager.com/gtag/js?id=UA-251765180-1 |  142.250.74.168 | 200 OK | 70 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=UA-251765180-1 IP142.250.74.168:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52 ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT
File typeJavaScript source, ASCII text, with very long lines (1763) Hashbfed87e025b2da8c13cc96fb2d7636c0 6575288f8c4e116db4cb87e3345d6d63da05645e 31d989c30bdb47a1df00745c1f2cc84a1204cf6e861092e178cd565a64523129
GET /gtag/js?id=UA-251765180-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 18:57:32 GMT
expires: Fri, 26 Apr 2024 18:57:32 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 18:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 69953
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-5SMVWLEDQQ | 142.250.74.168 | 200 OK | 101 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-5SMVWLEDQQ IP142.250.74.168:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52 ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT
File typeJavaScript source, ASCII text, with very long lines (5945) Size101 kB (100701 bytes) Hash7ba8aa9b3a2d1658e55aa537db84fc03 a500e581841aeea7ea0af3a03ea97fb9e324c4f7 0107b915fe57501ec259269ecd3ae87d73cb90f3d98de76e15588f08dc091eed
GET /gtag/js?id=G-5SMVWLEDQQ HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 18:57:32 GMT
expires: Fri, 26 Apr 2024 18:57:32 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 100701
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| feedbackrapt.com/58/cb/ac/58cbacd70dbd8d0cad21a696983e98ee.js | 172.240.108.84 | 200 OK | 16 kB |
URL GET HTTP/1.1feedbackrapt.com/58/cb/ac/58cbacd70dbd8d0cad21a696983e98ee.js IP172.240.108.84:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectfeedbackrapt.com Fingerprint81:8C:C9:A2:C2:9A:2B:32:79:07:9E:46:56:C4:78:6E:C8:6F:43:AC ValidityTue, 02 Apr 2024 11:37:49 GMT - Mon, 01 Jul 2024 11:37:48 GMT
File typeJavaScript source, ASCII text, with very long lines (44075), with no line terminators Hasha006b7caa02b4fc80121d9ba792706ae 4afeb076c4fee64669f902b047e51f2f856829d8 9f4b3633022ff981ccdb35d80e9199cd5a4baede39a9afb4cc7d93dcb6f9c559
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /58/cb/ac/58cbacd70dbd8d0cad21a696983e98ee.js HTTP/1.1
Host: feedbackrapt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1efa1527ed8eddab9e117cf33b4bdcc7
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| feedbackrapt.com/e6/9b/e4/e69be4c549af48660bae6788101a6810.js | 172.240.108.84 | 200 OK | 30 kB |
URL GET HTTP/1.1feedbackrapt.com/e6/9b/e4/e69be4c549af48660bae6788101a6810.js IP172.240.108.84:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectfeedbackrapt.com Fingerprint81:8C:C9:A2:C2:9A:2B:32:79:07:9E:46:56:C4:78:6E:C8:6F:43:AC ValidityTue, 02 Apr 2024 11:37:49 GMT - Mon, 01 Jul 2024 11:37:48 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashf388a18547f0eef5c296e9a70bfa8f85 89c7fbad20eb0e1c7674f105beac3f8a4613cde0 a14540d114cdc9d3921a616c9da1927f7f0cf71628f1411280a864b56f215a00
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /e6/9b/e4/e69be4c549af48660bae6788101a6810.js HTTP/1.1
Host: feedbackrapt.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:32 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_CF-2931_layer=0; expires=Sun, 28 Apr 2024 18:57:32 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9f634c24ed60bf169a1627f331457aca
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| proftrafficcounter.com/stats |  18.185.247.192 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.185.247.192:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hash061d08cd552aa75336d5bcb0fdb6908d 6295750bbc30c4be9b51b2967bf5fc1897408c74 05d7c842c643b04c6f0a8d4caf543a0e55eaa51c85313ea2a33659a8a2a274b8
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://wookafr.cyou
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; expires=Mon, 24 Apr 2034 18:57:33 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| proftrafficcounter.com/stats | 18.185.247.192 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.185.247.192:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hashf9b9dbc66ae08c5770fed0d11cb4ef06 80d584d1a67bda903c1e63c9078d5e9e622b012c 7bd96ad253fbf1e4367ae1bf3b821db5f7ca6e34b134ade35f1461787e50e1e5
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://wookafr.cyou
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=21517c69-e912-448f-a155-153a8011e8a8:2:1; expires=Mon, 24 Apr 2034 18:57:33 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 | 216.58.207.227 | 200 OK | 47 kB |
URL GET HTTP/2fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 IP216.58.207.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 46704, version 1.0 Hash30a274cd01b6eeb0b082c918b0697f1e 393311bde26b99a4ad935fa55bad1dce7994388b 88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
GET /s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46704
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:00:52 GMT
expires: Sat, 26 Apr 2025 06:00:52 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
age: 46601
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 | 216.58.207.227 | 200 OK | 47 kB |
URL GET HTTP/2fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 IP216.58.207.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 46704, version 1.0 Hash30a274cd01b6eeb0b082c918b0697f1e 393311bde26b99a4ad935fa55bad1dce7994388b 88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
GET /s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46704
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:00:52 GMT
expires: Sat, 26 Apr 2025 06:00:52 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
age: 46601
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| downstairsnegotiatebarren.com/sfp.js |  104.21.35.227 | 200 OK | 35 kB |
URL GET HTTP/2downstairsnegotiatebarren.com/sfp.js IP104.21.35.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectdownstairsnegotiatebarren.com Fingerprint2C:6A:E1:8E:26:5B:1D:8B:86:CB:C1:72:4E:52:4B:8B:67:3A:D2:44 ValidityMon, 04 Mar 2024 21:53:07 GMT - Sun, 02 Jun 2024 21:53:06 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators Hashf4a2f8f9f99541c6f105bbd0a025bd40 1f8e3eff12168fdd9e719adfc098d24a45b6916a b717cb04231a10d425fd55b73c85a5407119c6826a8bac94142fddfff6958716
GET /sfp.js HTTP/1.1
Host: downstairsnegotiatebarren.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: f06d20336d9ddd7023b996527e36462c
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 26 Apr 2024 18:57:32 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HBTUmcBLwOwN%2FDuiJF9IkAAwQOOrgon9BWy1EgEQbndDFY1qZGWoUD77AzWSZ5qMik%2BwFzlq3C8wbkqvzKx2k6OL2iOA5hq8jtPOkpdhAPT5eojjYg7cJdPrJhBZTN9R1wrUCLTmbPtwMQHeTi9RUA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc957fe45688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| dcba.popcash.net/znWaa3gu | 34.232.119.213 | 204 No Content | 0 B |
URL GET HTTP/2dcba.popcash.net/znWaa3gu IP34.232.119.213:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGlobalSign nv-sa Subject*.popcash.net FingerprintA0:E4:6F:A1:1E:C7:11:C2:B8:32:AF:92:D9:B2:34:05:44:6C:13:AE ValiditySat, 17 Jun 2023 15:33:27 GMT - Thu, 18 Jul 2024 15:33:26 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /znWaa3gu HTTP/1.1
Host: dcba.popcash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Fri, 26 Apr 2024 18:57:33 GMT
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
X-Firefox-Spdy: h2
|
|
| wookafr.cyou/storage/branding_media/3477fb0d-8e0d-47af-877e-459bf51a2493.png | 104.21.37.216 | 200 OK | 16 kB |
URL GET HTTP/3wookafr.cyou/storage/branding_media/3477fb0d-8e0d-47af-877e-459bf51a2493.png IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 490 x 115, 8-bit/color RGBA, non-interlaced Hash5b0d357bc3fc78af33bcfe3da65a19ae 11fd48cb0f28cafdba0eb944cdb236d34e8da116 28a9db6c5f42ff478f298ab5284d783b2810f985589e2664098b8434701a88ca
GET /storage/branding_media/3477fb0d-8e0d-47af-877e-459bf51a2493.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: image/png
content-length: 16083
last-modified: Thu, 28 Mar 2024 17:16:56 GMT
etag: "3ed3-614bbb0af9200"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 987
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JoolSA1K0HVl3H99xhhnoQFAjQg6SP5eMT2a6mx2n2zxwQdPf8EUxf36ZWUxs396gcNjDDg6HKNembxCVe2Wt4M1a3B%2BOc5Hqa7OufXDe8RdvT%2FWp4pdGSFMu72CgSg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc996b48b523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/storage/banner_website/telegram.png | 104.21.37.216 | 200 OK | 18 kB |
URL GET HTTP/3wookafr.cyou/storage/banner_website/telegram.png IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 1200 x 150, 8-bit/color RGBA, non-interlaced Hash76428223e2bc70c102b14b2277541718 37767ca9615fde8a91b4188177b86b95cbab2941 8f2cd62b994ff232321d094f48c3566794f050196310d2968f04208021886ca7
GET /storage/banner_website/telegram.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: image/png
content-length: 18462
last-modified: Thu, 21 Mar 2024 18:41:29 GMT
etag: "481e-614300e2bc840"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 987
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2Fw%2B9c%2FdPBoSc6ukJ%2Bc0Px%2BBWYm9CQMdb8k0%2FeCH9u1fisVgpgDICgNcuaDrkAhEyrxxk95e5gkcPRjkqWhzp%2BhjKg%2F1PwyH5dceIdqK6btFTPDhTG8mk378DldRpNs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc999b9ab523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| capaciousdrewreligion.com/advertisers.js | 172.240.127.234 | 200 OK | 0 B |
URL GET HTTP/1.1capaciousdrewreligion.com/advertisers.js IP172.240.127.234:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectcapaciousdrewreligion.com Fingerprint53:B6:ED:C6:B5:B6:60:3E:6D:02:5A:92:2E:C3:12:74:64:A1:23:DC ValidityWed, 06 Mar 2024 11:57:32 GMT - Tue, 04 Jun 2024 11:57:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /advertisers.js HTTP/1.1
Host: capaciousdrewreligion.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:33 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2efff1ee67a58a1bfc9cd01f7b2db7c6
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| wookafr.cyou/build/assets/main-cf061d56.js | 104.21.37.216 | 200 OK | 256 kB |
URL GET HTTP/3wookafr.cyou/build/assets/main-cf061d56.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeJavaScript source, ASCII text, with very long lines (37554) Size256 kB (255688 bytes) Hash2283d09f1d10ead601f39120e7bc50c2 4e9da5692b737e98649b7a596d4448454c8be99a 3630a3b3f6d84bc1364c2031ca41df5e134a4535f92c650bc221ac47e900134e
GET /build/assets/main-cf061d56.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:32 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"bcc1b-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fiVlkOfi6z5iHRJkAtS8%2FLGZsdF5KrppsT%2Fy93Udp7c48LrgpRr2zBJK9It2kck%2BZ4VR368yMK0jstwmLzEttJVXrBV6Wnm%2BZ9Ke5q7mDbDeBXRImKiPPhp9dqk3PUE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc8f3a34b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| hewomenentail.com/sbar.json?key=58cbacd70dbd8d0cad21a696983e98ee&uuid=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1 | 192.243.59.12 | 200 OK | 8.3 kB |
URL GET HTTP/1.1hewomenentail.com/sbar.json?key=58cbacd70dbd8d0cad21a696983e98ee&uuid=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd66dd7ebbc92990d50b523bc8f026ba9 6f5a8a768af540b0505be3a92ce7c5e6061f3df7 646280c92c09ff3ad454beaf2bc549158edb9fd0bd64308f44a509260ee36af0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /sbar.json?key=58cbacd70dbd8d0cad21a696983e98ee&uuid=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://wookafr.cyou
Access-Control-Allow-Origin: https://wookafr.cyou
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=22712266; expires=Sat, 27 Apr 2024 18:57:33 GMT; secure; SameSite=None
uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; expires=Fri, 03 May 2024 18:57:33 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 27 Apr 2024 18:57:34 GMT; secure; SameSite=None
uncs=1; expires=Sat, 27 Apr 2024 18:57:34 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sat, 27 Apr 2024 18:57:34 GMT; secure; SameSite=None
uncs29=1; expires=Sat, 27 Apr 2024 18:57:34 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4f743b4df01a7c716dad0306d187e305
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 | 216.58.207.227 | 200 OK | 47 kB |
URL GET HTTP/2fonts.gstatic.com/s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 IP216.58.207.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 46704, version 1.0 Hash30a274cd01b6eeb0b082c918b0697f1e 393311bde26b99a4ad935fa55bad1dce7994388b 88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
GET /s/inter/v13/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 46704
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:00:52 GMT
expires: Sat, 26 Apr 2025 06:00:52 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
content-type: font/woff2
age: 46602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| wookafr.cyou/build/assets/user-profile-link-b7f34a0a.js | 104.21.37.216 | 200 OK | 64 kB |
URL GET HTTP/3wookafr.cyou/build/assets/user-profile-link-b7f34a0a.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65534), with no line terminators Hash5f28eae2f0ca4c383b8ea01e5ce4fd8e 6321df2433d0c3f2b6c3e2be6f81562218e44e25 b35bff5e73b0704ea8a3ee80046f50917101bde0f49869692f9e20cf22ba867e
GET /build/assets/user-profile-link-b7f34a0a.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/build/assets/site-routes-2a1cdd99.js
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"306c0-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8XE1rqkm1IlGWk70IRm3U3sqVYTFUkZr%2FL1gooED9JKuY%2F863NYUhcghTOYSTjHXa9LUOMg4JQGBCjBuYl3mAU9%2Fw86QryYN3R%2B%2BNX91XdlP7Xo%2BF69yKJUL9XyVRuI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc97a8bfb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/build/assets/404-2-14c4a897.png | 104.21.37.216 | | 5.9 kB |
URL GET wookafr.cyou/build/assets/404-2-14c4a897.png IP104.21.37.216:0
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 516 x 190, 8-bit/color RGBA, non-interlaced Hashdc42df7f2447d30eb00c6157206dfb6e 632a616dd32cf1cfa4b9ced501287239aeedbbf5 14c4a897cdea748534b6788293935781e687fada8e1727148592878a454292f5
GET /build/assets/404-2-14c4a897.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6InE0SHhBdVZkdFM2TG5CSFlyNWZKbHc9PSIsInZhbHVlIjoiZytBbGFialowdk5WY0dwOXNuNGNlcnVUU2lXbmViQi80M0pLRFh3ZnZwQnRvbk5KTXhwcHZXVGRIdVYrWmpyckR5ZzNSZ0NQWHZZSjl1alg3bGtBRk5nRldPR2FmK0lSdStOM1V0djladnllQU1jY2RjUHdGRDRmWVp0Ry9ROGsiLCJtYWMiOiJhMDRlZGI2N2ZhNDJjNmYyNWYzZTE0OWI1ODgwNTFmNWRjOGQ4MzgyOGFkZjBjYzJjNmIxZDMzMWY3MTA3Mjc0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6ImlHZTlSWitETlJLR2MvaVpkNDdoREE9PSIsInZhbHVlIjoiUG13MGQ3NmR6elVreTV3bmNRblBjdGxNNFpMeSt3dlJCS01lUFM0SFJPOWRpaVdFVDd6NDkvWWNWQjNYc2pNcUtpeXBucUZQOHBnTzhycWdyQzdoU1JENXIya1NBenF0N3hmZzR6eGJ4eHMxZjlRTXRZTzR6OUpCSHZzYVlkSUoiLCJtYWMiOiJlOTgyMjdmM2FjZTExMDg0YTAyYjgyZDczNTc3YTA1YTJhNmJlYTI2NmEwMTk5YTViMjdmNmU0YTQ3YmQyN2Q0IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=hewomenentail.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 5924
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: "1724-6165a88e76e00"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 0
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cl1LolmnQbS4mobD0EnqfQ8l4D%2F1xXuxzYjBld2hXnVBUDVFWtqNd8rhInOmBOZzGCYPjj9WnFmqIYeX2bx36HmJR%2Bqa%2B8RzVRJVoJR3DlpMj2PCfxMlCpNS98irGuQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9c3856b523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/build/assets/404-1-176145e9.png | 104.21.37.216 | 200 OK | 19 kB |
URL GET HTTP/3wookafr.cyou/build/assets/404-1-176145e9.png IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 539 x 400, 8-bit/color RGBA, non-interlaced Hash09ac461516dda937afcbc9a3b623c54d 3990c87ffeedf00b5208a5d1a42460940fcb3a11 176145e91b05856cfdd1fc405af37c35250c80e971908be988f3f73657c9c93b
GET /build/assets/404-1-176145e9.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6InE0SHhBdVZkdFM2TG5CSFlyNWZKbHc9PSIsInZhbHVlIjoiZytBbGFialowdk5WY0dwOXNuNGNlcnVUU2lXbmViQi80M0pLRFh3ZnZwQnRvbk5KTXhwcHZXVGRIdVYrWmpyckR5ZzNSZ0NQWHZZSjl1alg3bGtBRk5nRldPR2FmK0lSdStOM1V0djladnllQU1jY2RjUHdGRDRmWVp0Ry9ROGsiLCJtYWMiOiJhMDRlZGI2N2ZhNDJjNmYyNWYzZTE0OWI1ODgwNTFmNWRjOGQ4MzgyOGFkZjBjYzJjNmIxZDMzMWY3MTA3Mjc0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6ImlHZTlSWitETlJLR2MvaVpkNDdoREE9PSIsInZhbHVlIjoiUG13MGQ3NmR6elVreTV3bmNRblBjdGxNNFpMeSt3dlJCS01lUFM0SFJPOWRpaVdFVDd6NDkvWWNWQjNYc2pNcUtpeXBucUZQOHBnTzhycWdyQzdoU1JENXIya1NBenF0N3hmZzR6eGJ4eHMxZjlRTXRZTzR6OUpCSHZzYVlkSUoiLCJtYWMiOiJlOTgyMjdmM2FjZTExMDg0YTAyYjgyZDczNTc3YTA1YTJhNmJlYTI2NmEwMTk5YTViMjdmNmU0YTQ3YmQyN2Q0IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=hewomenentail.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 18917
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: "49e5-6165a88e76e00"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=73wtmB3wMHlUZ4JZB1L4ISAUZ%2FV5ZBLzX0Ypwy3l2n2t56gNOQh%2F737%2BwZuhlmYtRL94lYlODUotGAG4b1hFkjfvV4BHa04KyJ9XF9AeZF%2BVkxp2PyFZME%2FRjIBRBmk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9c385bb523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| cdn.barscreative1.com/sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html | 45.133.44.4 | 200 OK | 440 B |
URL GET HTTP/2cdn.barscreative1.com/sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html IP45.133.44.4:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectcdn.barscreative1.com FingerprintF6:54:F4:B9:EB:AD:1E:FA:8F:76:B9:75:20:9B:41:57:32:37:94:E3 ValiditySun, 10 Mar 2024 03:01:32 GMT - Sat, 08 Jun 2024 03:01:31 GMT
File typeHTML document, ASCII text Hashf6990569c7ffeac1f4a3f6d9eee5da44 e7d5e37acf89a8faee252c36fc2c9d6615501d76 cc2a9756c81bd570fff8b32e48a413687c33f8abe9c934e743a0769178b4f690
GET /sb/au/0c/c8/e1/0cc8e13ba9d5dbc867b982993e805a9d/1632728593.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Mon, 27 Sep 2021 07:43:24 GMT
etag: W/"6151761c-52d"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Fri, 26 Apr 2024 19:57:34 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/img/close.png | 104.21.70.253 | 200 OK | 591 B |
URL GET HTTP/3cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/img/close.png IP104.21.70.253:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typePNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced Hash9fd5bcb6103d86e317bd1eb019bcbe71 6b5a52ea669dcb74946f2bed4bdd7ec985026113 0ddd3be104ac7945fb062096df62034a6a24ecc76ba92493c35c62c3c25982ae
GET /sb/ssp/vpn/classic-push/small/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 591
last-modified: Fri, 19 Jan 2024 14:19:42 GMT
etag: "65aa84fe-24f"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 6241947
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jAO30HtL6N87dJHe7w1StwveCOFgLCiGNu%2BRp7KnasPiaoAF%2BTOxeWH9MNWMAqgDTT2Fnuv6fI4Lf8DiAuONmRGKwFXc8FF9FoJQfWNza%2BKglnLFS9iiQt%2FvhnXDqB1p4Y2EATZzlOAx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9dcd5356a5-OSL
alt-svc: h3=":443"; ma=86400
|
|
| hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fanimate.css&l=78689&fd=42 | 192.243.59.12 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fanimate.css&l=78689&fd=42 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fanimate.css&l=78689&fd=42 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| wookafr.cyou/build/assets/BookmarkBorder-9cb375bd.js | 104.21.37.216 | 200 OK | 17 kB |
URL GET HTTP/3wookafr.cyou/build/assets/BookmarkBorder-9cb375bd.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeJava source, ASCII text, with very long lines (2605) Hash6f9183dc98cf931bcb9f0dde1bd3e6e8 efc43718fe797b4892a2469c9e12b8433613e2ee dda1a769134d24d6c53060b3291986a6d6feb9f6dcd7cc787e5fa12a008ef1a9
GET /build/assets/BookmarkBorder-9cb375bd.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/build/assets/site-routes-2a1cdd99.js
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"a62-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=McsaFv%2BqhYfit9ekC0djI26LOSBzzlGHdzEFOQkzuOjYXIvEWu6xLcDWJyxMN6JF2pYvqxIdUT%2BikVc89OQYncTnaPBOPIfN417rVFTwB3FVGMkPUnNz6YQEh5OyjM0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc97a8c2b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fjs%2Fscript.js&l=962&fd=22 | 192.243.59.12 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fjs%2Fscript.js&l=962&fd=22 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fjs%2Fscript.js&l=962&fd=22 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| unseenreport.com/pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=58cbacd70dbd8d0cad21a696983e98ee&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 | 192.243.61.227 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=58cbacd70dbd8d0cad21a696983e98ee&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=58cbacd70dbd8d0cad21a696983e98ee&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 3dc28b0fb0b3ae77c3a1cd095f1afb60
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=e69be4c549af48660bae6788101a6810&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 | 192.243.61.227 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=e69be4c549af48660bae6788101a6810&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=21517c69-e912-448f-a155-153a8011e8a8&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=e69be4c549af48660bae6788101a6810&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9a0295ac10ea6bd73a7b60cd86b42d8f
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| wookafr.cyou/favicon/icon-144x144.png | 104.21.37.216 | 200 OK | 5.4 kB |
URL GET HTTP/3wookafr.cyou/favicon/icon-144x144.png IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced Hashd5551c8a6ebf1c8b5f9c64615cc70864 6c520bb0eeb290cf4ca87db55e2a3c5d11a06b14 def2ae2c846693a0bfd8407619c5cd8af4d44f6093f7648b4f684d18c7b48d6d
GET /favicon/icon-144x144.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6InE0SHhBdVZkdFM2TG5CSFlyNWZKbHc9PSIsInZhbHVlIjoiZytBbGFialowdk5WY0dwOXNuNGNlcnVUU2lXbmViQi80M0pLRFh3ZnZwQnRvbk5KTXhwcHZXVGRIdVYrWmpyckR5ZzNSZ0NQWHZZSjl1alg3bGtBRk5nRldPR2FmK0lSdStOM1V0djladnllQU1jY2RjUHdGRDRmWVp0Ry9ROGsiLCJtYWMiOiJhMDRlZGI2N2ZhNDJjNmYyNWYzZTE0OWI1ODgwNTFmNWRjOGQ4MzgyOGFkZjBjYzJjNmIxZDMzMWY3MTA3Mjc0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6ImlHZTlSWitETlJLR2MvaVpkNDdoREE9PSIsInZhbHVlIjoiUG13MGQ3NmR6elVreTV3bmNRblBjdGxNNFpMeSt3dlJCS01lUFM0SFJPOWRpaVdFVDd6NDkvWWNWQjNYc2pNcUtpeXBucUZQOHBnTzhycWdyQzdoU1JENXIya1NBenF0N3hmZzR6eGJ4eHMxZjlRTXRZTzR6OUpCSHZzYVlkSUoiLCJtYWMiOiJlOTgyMjdmM2FjZTExMDg0YTAyYjgyZDczNTc3YTA1YTJhNmJlYTI2NmEwMTk5YTViMjdmNmU0YTQ3YmQyN2Q0IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=hewomenentail.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 5378
last-modified: Fri, 19 Jan 2024 19:08:20 GMT
etag: "1502-60f5134087100"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 6623
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FrPSxTUPzTjueWjsiJoajI1kHbC7T6gHJvyB0ieEnTUdBFGYTvyXSbUseqppMsO1C9aDfpEjgc5dFYKtUQM2%2Ft%2FlsvZbhV7hFqGq0HAzvDMQa%2FiMns1haz1yn8Xp3z0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cca03e76b523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/favicon/icon-192x192.png | 104.21.37.216 | 200 OK | 8.1 kB |
URL GET HTTP/3wookafr.cyou/favicon/icon-192x192.png IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced Hashd1ffd714e23e5e0b9d6fce35390c591d afdfc97df73a31d2b78eb33b4567c47951931be1 a659a9c30f1fac7e450c322c6f854d0ba4e573fe7cca5bde778039b5b6a8e272
GET /favicon/icon-192x192.png HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6InE0SHhBdVZkdFM2TG5CSFlyNWZKbHc9PSIsInZhbHVlIjoiZytBbGFialowdk5WY0dwOXNuNGNlcnVUU2lXbmViQi80M0pLRFh3ZnZwQnRvbk5KTXhwcHZXVGRIdVYrWmpyckR5ZzNSZ0NQWHZZSjl1alg3bGtBRk5nRldPR2FmK0lSdStOM1V0djladnllQU1jY2RjUHdGRDRmWVp0Ry9ROGsiLCJtYWMiOiJhMDRlZGI2N2ZhNDJjNmYyNWYzZTE0OWI1ODgwNTFmNWRjOGQ4MzgyOGFkZjBjYzJjNmIxZDMzMWY3MTA3Mjc0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6ImlHZTlSWitETlJLR2MvaVpkNDdoREE9PSIsInZhbHVlIjoiUG13MGQ3NmR6elVreTV3bmNRblBjdGxNNFpMeSt3dlJCS01lUFM0SFJPOWRpaVdFVDd6NDkvWWNWQjNYc2pNcUtpeXBucUZQOHBnTzhycWdyQzdoU1JENXIya1NBenF0N3hmZzR6eGJ4eHMxZjlRTXRZTzR6OUpCSHZzYVlkSUoiLCJtYWMiOiJlOTgyMjdmM2FjZTExMDg0YTAyYjgyZDczNTc3YTA1YTJhNmJlYTI2NmEwMTk5YTViMjdmNmU0YTQ3YmQyN2Q0IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=hewomenentail.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 8102
last-modified: Fri, 19 Jan 2024 19:08:20 GMT
etag: "1fa6-60f5134087100"
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 6623
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ToRFdPBBfN9vI43O4E3eevgbRX8%2BEA8TNRnpknrz1cQF1JsR7u1IxbIwzkASxB40GPb0JMngYpBdC9Lu4tSaUpk%2FDXVlmjSZlZnOYqmvRYkFpPzx5fKJGvnbd22ADeA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cca03e73b523-OSL
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/build/assets/linkify.es-ff711e62.js | 104.21.37.216 | 200 OK | 9.5 kB |
URL GET HTTP/3wookafr.cyou/build/assets/linkify.es-ff711e62.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeUnicode text, UTF-8 text, with very long lines (8401) Hash703cd1bddf4d172a7cac2a415998e444 9a6e8f9c89537370a2fad47b038c086ec0cb96a7 d8824343907cf5ce7c87774bc835df948a02271500ff6dcfadd369bcffd38192
GET /build/assets/linkify.es-ff711e62.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/build/assets/site-routes-2a1cdd99.js
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"454d-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jtOXq4w95hVTXqXPFEyqNbU%2Foylmu%2BT7GJGOlLsV8lsvsHLzIR0yYG347S6Bka7HKXpgoNj9cur7DK40TgK1hK0k0v5mgUNkazq1LMVggAVIfZm2LPuNVhTA5HvCwXM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc97a8cdb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/3fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0 Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:02:10 GMT
expires: Sat, 26 Apr 2025 06:02:10 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 46524
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/3fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 IP216.58.207.227:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15860, version 1.0 Hashe9f5aaf547f165386cd313b995dddd8e acdef5603c2387b0e5bffd744b679a24a8bc1968 f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:55:49 GMT
expires: Sat, 26 Apr 2025 05:55:49 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 46905
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| hewomenentail.com/pixel/sbs?c=1 | 172.240.108.84 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/pixel/sbs?c=1 IP172.240.108.84:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbs?c=1 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| hewomenentail.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuzuYmCMoehEWZg4cVzaR7fva4h8W4RoJxE3YjLl6kfvWknOqupqp7epJTcEH25uBf0Pkm2aAusgueBBeZLAgGhB1POZiL%2F4HigjeZcXD0Heq9V99X8NX33meH%2BQWpIafnN943%2B0prutqs%2BpWrd4LgWmVTJfmgMghbH7ca1yq2%2F2anVfVfq7wrec%2Bs1vzA9wM%2FqKwrKyMzWJ2CUOmDTlDt%2BNVGrRo0GxjY%2F%2Fcu9%2BCoB9G%2FIC9CicnyE%2B8yFB8jiR%2FekK6XmfSNd%2BJc08xY9MXJB0kvMUWCeFFG1kOUnMzZMO7p%2BmOY5HgmF6b%2FL5GpCfF%2BfAyWnMxFgvWPZjqZhkzAxHMo%2BmNIPYaiY3BzF0o8JQAXuLmFJL5%2F09iC7v2D0ik6IcvP%2FoAqJmT518tI4m%2FWtBpUbhudZ8okDoOohBqMobpjpPkpsv0lqOIUPPsUSvxMVp9tIomPtpw2UOL8VR5KP2z6zRXKGrWVRhQ0VzosFCvtZqNTZ34nqLXaM4OUGkNFY2g5BHWXkDsPufKQRx7y1EMszis8CIK2Lzj1ww7nddGWrCX8gLajgAZ%2BK0TOp38YIkuH4HoIbg%2BQ2gP01BA2%2FwFut4QTHlxG0BclCklQOIKCEhSKoMgIin55LLSrufK%2B0C5nwTzX5rlejkzWPaTHJuvKhIDaIawoD9ML8sLUQO%2Bjz39CT55XmiFnlIu2L5gIhc%2BpqAW01Wl1wrrshFLCqRLKLYE6D%2FtqQtp%2F7iBVE%2FLS2h0wegqnT8GVB5q%2FDFqUoLsl9pNvC2N6NLIrJooUV1JXuYkhTIk0W0a25x3qC3JlNsqNrUeQ%2FOz6b%2FVZgNsSqS3xiXpC0NX3RrdMQY5umcKRR1tppmK1T6djvp3RTF766j25VxgrNm644Zdv8SkwLR%2FsSJdt0kSopOvI12tKCGnXjeWSfL%2FhPpRsO3e7a7lN8nRz%2B%2B31jTi10jllkjHodGN%2Ft%2BBqQp6%2FsjPb4KvfbUPZMWxeIs7PyDygzBg8PYBLF%2FqdIbB6wWGphyIvR7bGFpdaEWi56Ckr4f7Ts0U9snT6mqry0N1D1y6BZneRxCX6tkRfl6B6CJdfGmWpPbv%2By1wG00sjpu3SEdNWfzGzeXo8hFPnlbov2kxGss1ko9mIJBes2WQ%2BjzirizDkyNwkev2vV%2F4GAAD%2F%2FwEAAP%2F%2FjCpjjJsEAAA%3D | 192.243.59.12 | 200 OK | 7 B |
URL GET HTTP/1.1hewomenentail.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuzuYmCMoehEWZg4cVzaR7fva4h8W4RoJxE3YjLl6kfvWknOqupqp7epJTcEH25uBf0Pkm2aAusgueBBeZLAgGhB1POZiL%2F4HigjeZcXD0Heq9V99X8NX33meH%2BQWpIafnN943%2B0prutqs%2BpWrd4LgWmVTJfmgMghbH7ca1yq2%2F2anVfVfq7wrec%2Bs1vzA9wM%2FqKwrKyMzWJ2CUOmDTlDt%2BNVGrRo0GxjY%2F%2Fcu9%2BCoB9G%2FIC9CicnyE%2B8yFB8jiR%2FekK6XmfSNd%2BJc08xY9MXJB0kvMUWCeFFG1kOUnMzZMO7p%2BmOY5HgmF6b%2FL5GpCfF%2BfAyWnMxFgvWPZjqZhkzAxHMo%2BmNIPYaiY3BzF0o8JQAXuLmFJL5%2F09iC7v2D0ik6IcvP%2FoAqJmT518tI4m%2FWtBpUbhudZ8okDoOohBqMobpjpPkpsv0lqOIUPPsUSvxMVp9tIomPtpw2UOL8VR5KP2z6zRXKGrWVRhQ0VzosFCvtZqNTZ34nqLXaM4OUGkNFY2g5BHWXkDsPufKQRx7y1EMszis8CIK2Lzj1ww7nddGWrCX8gLajgAZ%2BK0TOp38YIkuH4HoIbg%2BQ2gP01BA2%2FwFut4QTHlxG0BclCklQOIKCEhSKoMgIin55LLSrufK%2B0C5nwTzX5rlejkzWPaTHJuvKhIDaIawoD9ML8sLUQO%2Bjz39CT55XmiFnlIu2L5gIhc%2BpqAW01Wl1wrrshFLCqRLKLYE6D%2FtqQtp%2F7iBVE%2FLS2h0wegqnT8GVB5q%2FDFqUoLsl9pNvC2N6NLIrJooUV1JXuYkhTIk0W0a25x3qC3JlNsqNrUeQ%2FOz6b%2FVZgNsSqS3xiXpC0NX3RrdMQY5umcKRR1tppmK1T6djvp3RTF766j25VxgrNm644Zdv8SkwLR%2FsSJdt0kSopOvI12tKCGnXjeWSfL%2FhPpRsO3e7a7lN8nRz%2B%2B31jTi10jllkjHodGN%2Ft%2BBqQp6%2FsjPb4KvfbUPZMWxeIs7PyDygzBg8PYBLF%2FqdIbB6wWGphyIvR7bGFpdaEWi56Ckr4f7Ts0U9snT6mqry0N1D1y6BZneRxCX6tkRfl6B6CJdfGmWpPbv%2By1wG00sjpu3SEdNWfzGzeXo8hFPnlbov2kxGss1ko9mIJBes2WQ%2BjzirizDkyNwkev2vV%2F4GAAD%2F%2FwEAAP%2F%2FjCpjjJsEAAA%3D IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz2skRRSuzuYmCMoehEWZg4cVzaR7fva4h8W4RoJxE3YjLl6kfvWknOqupqp7epJTcEH25uBf0Pkm2aAusgueBBeZLAgGhB1POZiL%2F4HigjeZcXD0Heq9V99X8NX33meH%2BQWpIafnN943%2B0prutqs%2BpWrd4LgWmVTJfmgMghbH7ca1yq2%2F2anVfVfq7wrec%2Bs1vzA9wM%2FqKwrKyMzWJ2CUOmDTlDt%2BNVGrRo0GxjY%2F%2Fcu9%2BCoB9G%2FIC9CicnyE%2B8yFB8jiR%2FekK6XmfSNd%2BJc08xY9MXJB0kvMUWCeFFG1kOUnMzZMO7p%2BmOY5HgmF6b%2FL5GpCfF%2BfAyWnMxFgvWPZjqZhkzAxHMo%2BmNIPYaiY3BzF0o8JQAXuLmFJL5%2F09iC7v2D0ik6IcvP%2FoAqJmT518tI4m%2FWtBpUbhudZ8okDoOohBqMobpjpPkpsv0lqOIUPPsUSvxMVp9tIomPtpw2UOL8VR5KP2z6zRXKGrWVRhQ0VzosFCvtZqNTZ34nqLXaM4OUGkNFY2g5BHWXkDsPufKQRx7y1EMszis8CIK2Lzj1ww7nddGWrCX8gLajgAZ%2BK0TOp38YIkuH4HoIbg%2BQ2gP01BA2%2FwFut4QTHlxG0BclCklQOIKCEhSKoMgIin55LLSrufK%2B0C5nwTzX5rlejkzWPaTHJuvKhIDaIawoD9ML8sLUQO%2Bjz39CT55XmiFnlIu2L5gIhc%2BpqAW01Wl1wrrshFLCqRLKLYE6D%2FtqQtp%2F7iBVE%2FLS2h0wegqnT8GVB5q%2FDFqUoLsl9pNvC2N6NLIrJooUV1JXuYkhTIk0W0a25x3qC3JlNsqNrUeQ%2FOz6b%2FVZgNsSqS3xiXpC0NX3RrdMQY5umcKRR1tppmK1T6djvp3RTF766j25VxgrNm644Zdv8SkwLR%2FsSJdt0kSopOvI12tKCGnXjeWSfL%2FhPpRsO3e7a7lN8nRz%2B%2B31jTi10jllkjHodGN%2Ft%2BBqQp6%2FsjPb4KvfbUPZMWxeIs7PyDygzBg8PYBLF%2FqdIbB6wWGphyIvR7bGFpdaEWi56Ckr4f7Ts0U9snT6mqry0N1D1y6BZneRxCX6tkRfl6B6CJdfGmWpPbv%2By1wG00sjpu3SEdNWfzGzeXo8hFPnlbov2kxGss1ko9mIJBes2WQ%2BjzirizDkyNwkev2vV%2F4GAAD%2F%2FwEAAP%2F%2FjCpjjJsEAAA%3D HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: feb919504de134750bad11b389fb4f17
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| wookafr.cyou/build/assets/main-6c4dbbeb.css | 104.21.37.216 | 200 OK | 95 kB |
URL GET HTTP/3wookafr.cyou/build/assets/main-6c4dbbeb.css IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /build/assets/main-6c4dbbeb.css HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:32 GMT
content-type: text/css
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"173ad-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: HIT
age: 987
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lIGxF8ZTcu%2FV64sgCJ7TO5PEIzmnqYBuAxTBh3201c%2FytodK2NLL%2B%2F%2FznuDzNfNPPBwvzzkLAAOSzTcM5ch36EEATGcxAA0u%2B2tY3478opo%2FUCZtAZyhTK9QtYpRrxc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc8f3a31b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/api/v1/value-lists/localizations | 104.21.37.216 | 200 OK | 134 B |
URL GET HTTP/3wookafr.cyou/api/v1/value-lists/localizations IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typetroff or preprocessor input, ASCII text, with no line terminators Hashec6b745a402e3ff6f448aafbb890cbaa 01eb0a15360b6b13a1312dcccb58f341a0148618 efec3caec020a9a06c9c000196b1ba427a9cb95432670b7249ad357d1a6f1ba0
GET /api/v1/value-lists/localizations HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-XSRF-TOKEN: eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0=
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: application/json
x-powered-by: PHP/8.2.18, PleskLin
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
x-ratelimit-limit: 1500
x-ratelimit-remaining: 1499
access-control-allow-origin: *
vary: Accept-Encoding
set-cookie: XSRF-TOKEN=eyJpdiI6InE0SHhBdVZkdFM2TG5CSFlyNWZKbHc9PSIsInZhbHVlIjoiZytBbGFialowdk5WY0dwOXNuNGNlcnVUU2lXbmViQi80M0pLRFh3ZnZwQnRvbk5KTXhwcHZXVGRIdVYrWmpyckR5ZzNSZ0NQWHZZSjl1alg3bGtBRk5nRldPR2FmK0lSdStOM1V0djladnllQU1jY2RjUHdGRDRmWVp0Ry9ROGsiLCJtYWMiOiJhMDRlZGI2N2ZhNDJjNmYyNWYzZTE0OWI1ODgwNTFmNWRjOGQ4MzgyOGFkZjBjYzJjNmIxZDMzMWY3MTA3Mjc0IiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:34 GMT; Max-Age=7200; path=/; secure; samesite=lax
wookafr_session=eyJpdiI6ImlHZTlSWitETlJLR2MvaVpkNDdoREE9PSIsInZhbHVlIjoiUG13MGQ3NmR6elVreTV3bmNRblBjdGxNNFpMeSt3dlJCS01lUFM0SFJPOWRpaVdFVDd6NDkvWWNWQjNYc2pNcUtpeXBucUZQOHBnTzhycWdyQzdoU1JENXIya1NBenF0N3hmZzR6eGJ4eHMxZjlRTXRZTzR6OUpCSHZzYVlkSUoiLCJtYWMiOiJlOTgyMjdmM2FjZTExMDg0YTAyYjgyZDczNTc3YTA1YTJhNmJlYTI2NmEwMTk5YTViMjdmNmU0YTQ3YmQyN2Q0IiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:34 GMT; Max-Age=7200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4LXstnQkZqnpZZz4bCvOqyC7TmtNvASl0ssG%2BXkxdsgTe3Z8tT5Qa2nV7PTMSjVU3mDP%2BTSEnMqmIWriJ%2BrxE0S6N5PZa5YGmKMZZaXTJWXqi3NjBHrJZBPaUD4mqQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc99dc06b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| wookafr.cyou/build/assets/site-routes-2a1cdd99.js | 104.21.37.216 | 200 OK | 152 kB |
URL GET HTTP/3wookafr.cyou/build/assets/site-routes-2a1cdd99.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
Size152 kB (152511 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /build/assets/site-routes-2a1cdd99.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/build/assets/main-cf061d56.js
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"253bf-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Fln1kO1nPY0FTnZlvSHZ%2BQBvAuhFK5gITr5eCYhuvohMRu830uqJtHh8%2BnJIuWmgx4eZ5xHOM3UNkKoOU8PM%2FJoZ66yR7XK5wXhS9cWEticsfQRUjLcNuZdJlde9Jw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc95fdf1b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F0c%2Fc8%2Fe1%2F0cc8e13ba9d5dbc867b982993e805a9d%2F1632728593.html&l=1325&fd=125 | 192.243.59.12 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F0c%2Fc8%2Fe1%2F0cc8e13ba9d5dbc867b982993e805a9d%2F1632728593.html&l=1325&fd=125 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F0c%2Fc8%2Fe1%2F0cc8e13ba9d5dbc867b982993e805a9d%2F1632728593.html&l=1325&fd=125 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| cdn.popcash.net/show.js |  194.242.11.186 | 200 OK | 111 kB |
IP194.242.11.186:443 ASN#34989 ServeTheWorld AS
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectcdn.popcash.net Fingerprint72:AF:EB:EA:E5:AE:80:AD:4B:BA:87:C8:DB:6F:4E:AC:E6:67:FD:9E ValidityWed, 10 Apr 2024 13:11:33 GMT - Tue, 09 Jul 2024 13:11:32 GMT
File typeJavaScript source, ASCII text, with very long lines (65387) Size111 kB (110983 bytes) Hash9e6547a4a8c7fb03ef853941d5a5a9e4 249e23762ec9df552971c818d1fa8b8ae60f2010 9c222b83f475f1acfcb9d34130f4e778fa943d8c7f9d5c71bc0725582f95494f
GET /show.js HTTP/1.1
Host: cdn.popcash.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
server: BunnyCDN-NO1-830
cdn-pullzone: 1818418
cdn-uid: 81f0ee8a-6b19-463e-a8be-46c199377685
cdn-requestcountrycode: NO
vary: Accept-Encoding, Accept-Encoding
cache-control: public, max-age=2592000
etag: W/"661ce329-1b187"
expires: Wed, 15 May 2024 08:27:35 GMT
last-modified: Mon, 15 Apr 2024 08:19:53 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4aQPF46dZHuHB7CGFjbiXCUurhxVoXgSHMC11W9o6P8mkuiwOP%2BuROh76eYugNvU3NkKnlaXpx51mgmR%2F6pZvJXmZ4B27n3oFn6AkNmZ1sjSDKGgR2sg%2BU7HRSXr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 874a8eacda81569d-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 04/15/2024 08:27:35
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 770d070b706156d71ce6fc65699b304f
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/animate.css | 104.21.70.253 | 200 OK | 79 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/animate.css IP104.21.70.253:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
Hash3d4123dbfb33d27a5cfdfcfa91df6783 e7d0eeeec54b848f0bc3da8685fa3bc88429d660 cb7d1393b65701b2f97d8da244c2c6023e9cbc3463ecb0136b915cfc775c6887
GET /sb/ssp/vpn/classic-push/small/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: text/css
last-modified: Fri, 19 Jan 2024 14:19:42 GMT
etag: W/"65aa84fe-13361"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 109178
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EeRUaUKSmPF4Jb2aj0%2FOmWfUi0uG7h5uTVCzFiwwGP2ufMu9lO%2B1L7krMIs%2B5KJfCE4j0%2BgkmolbODc4vG5tq9bcLGhcMrv20EiBg%2BowSFr%2BxCYCnu0VTAzP3o5EK%2BOBqc6rpPQ4JDxX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9d2da25685-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/style.css | 104.21.70.253 | 200 OK | 3.4 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/css/style.css IP104.21.70.253:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeASCII text, with very long lines (3537), with no line terminators Hashb8a277e051f047a41d3229377460f0c9 596b934114e1b6e3cee15ef19925c7f2ff5607e7 9cf981fe6d59b72cb9d12e4bc958983bac07f16b8f1b40bb1c6ced0bf2d6b2d0
GET /sb/ssp/vpn/classic-push/small/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: text/css
last-modified: Fri, 19 Jan 2024 14:19:42 GMT
etag: W/"65aa84fe-d1b"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 109178
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ti4asRCHOF6Dun%2FiFz034bSqOADSK7NlXwwlRTopEthnrg1vDPjDnGcVf5jsHuOgSleT9H%2FwEX0bz3mk09wgu9dCKl9vYO8uY2HarPC4uH1TbWQq5pDxZhDcSesXO1aJGebxARVXJhyN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9d3da75685-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| | 104.21.37.216 | 200 OK | 204 kB |
URL User Request GET HTTP/2IP104.21.37.216:443
CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeHTML document, ASCII text, with very long lines (63839) Size204 kB (204284 bytes) Hash9e6e6df4721bc62d9bfbe97a910b34f2 6ccaaefed61545b6c740dd75da4136b7280bc1e5 e25d72a1146c3b36c478bcff88d541a0ad3a156ce88a2aa150f956a12c94121c
GET /meta.json HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:31 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.2.18, PleskLin
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
server-timing: bootstrap;desc="Bootstrap";dur=96.085071563721, app;desc="App";dur=18, total;desc="Total";dur=114.59302902222,
vary: Accept-Encoding
set-cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:31 GMT; Max-Age=7200; path=/; secure; samesite=lax
wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:31 GMT; Max-Age=7200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ilmLwil2PSqYrhHv09zeCBidCVnPe6CNab0fCmJETacL4V%2FjxIdSsLe%2BYTflEvshilJ3hnLVL8Ibkoz%2BxY1ngvSXn44Xj9Yq4WH08m925Joebt8AMwwQ0GCZCVcZ3%2Fo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc8c0938b4f4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| wookafr.cyou/build/assets/OpenInNew-7a0fd0e3.js | 104.21.37.216 | 200 OK | 3.9 kB |
URL GET HTTP/3wookafr.cyou/build/assets/OpenInNew-7a0fd0e3.js IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (3974), with no line terminators Hash970ef2ba70ac74d2c2472c1e48279eaf f1a8bb5a401024e2ce7478e94dd517bca647f2be a0ae1ed25f1e14107563eb25fe735e5aae71829ed5d87cae69642367144f8d7e
GET /build/assets/OpenInNew-7a0fd0e3.js HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/build/assets/site-routes-2a1cdd99.js
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=c8e08505-ab42-4f15-9b8d-75493b091267%3A3%3A1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:33 GMT
content-type: application/javascript
last-modified: Thu, 18 Apr 2024 08:12:40 GMT
etag: W/"f0c-6165a88e76e00-gzip"
vary: Accept-Encoding
x-powered-by: PleskLin
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JHe7edsTcJDiUSRnuxWdSWySrR63IDaaprI%2BJB1RtN7ZQyQ%2F5bX16Vv92AiDZ%2BgrrzoPHZ%2B%2BrG4O9PzxWBEcLnFSF%2BytVKsEzPGxtHEiTLy9nGWvjQXZq4mG7pq7veI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc97a8c8b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| hewomenentail.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQWskRRSuzuYmCMoehEWZg4cVzaS7Z6Znxj0sxjUSjJuwG3HxItVV1ZNyqruaqu7pSU7BBdmbg7%2Bg802yQV1kFzwJLtJZEAwIO55yMBf%2FgeKCN5lxcPQd6r1X31fw1ffeZ4f5BfGR0%2FMb7%2Bt9qRRdbdXd2tU7nnettimTfFgbdoKPg%2Ba1mhm82Q3q7mu1dwXr61Xf9VzXc73aujQi0sPVKQiZPuh69a5bb%2Fp1r9XE0Py%2Ft7kDSx3wwQV5EZJPlp84lyFZhSR%2BeEPYfqbTN96Jc0UzbTDgJx8k%2FUQXCeJFGRkHUXIyZ0Pbp%2BuPoZPjmVzowb%2FEUE6I8%2BNjhMnJXCTCwdFMZ6ggEoT8ORSDCkJVkLQC03ch%2BVMCMI6bW0ji%2Bze1KejePyidohOy%2FOwPyGJCln%2B9jCT%2BZk3JYe22VnkmdWIxjErIYQXZq5Dmp8j2lyCLU7DsU0j%2BM1l9tokkPtqySkPy81dZR7idlttaoWHTX2lGXmulG3b4SrvV7DZCt%2Bv5QXtmkJQVZFRBiRGovYTcOsilgzxykKcOYn5eY57ntV3OqNvpMtbgbREG3PVoO%2FKo5wYd5Gz6hxGydASmRmDmAKk5QF%2BOYPIfYHdLWO7AZgQDXqIQBIUlKChBIQmKjKAYlMdcWd%2BW97myeejNsz%2FPjXKss94hPdZZTyQE1IxgeHmYXpAXpgY6H33%2BE%2FrivNbqsJAy3nZ5yDvcZZT7Hg26QbfTEN2OELCyhLRLoNbBvpyQ9p87SOWEvLR2ByE9hVWnYNIBzV8GLUrQ3RL7ybeF1n0amRUdRZJJoepMx%2BC6RJotI9tzDtUFuTIb5cbWIwh2dv23xizATInUlPhEPiHoqXvjW7ogR7d0YcmjrTSTsdyn0zHfzmgmLn31ntgrtOEbN%2Bzoy7fYFJiWD3aEzTZpwmXSs%2BTrNcm5MOvaMEG%2B37AfinA7t7truUnydHP77fWNODXCWqmTCnS6sb8bMDkhz1%2FZmW3w1e%2B2IU0Fk5eI8zMyD0hdgaUHsOlCv9UERi04YeqgyMux8cPFpZIESix6Gpaw%2F%2BnDRT02dPqayvLQ3kPPLIFmd5HEJQamxECVoGoEm18aZ6k5u%2F7LXEaolsahMktHoTLqi5nN0%2BMhrDyvtRsNlwbdltduU9EOm34nCjxOqd8M%2FCCgDWR2Er3%2B1yt%2FAwAA%2F%2F8BAAD%2F%2Fwz%2BtmSbBAAA | 192.243.59.12 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSQWskRRSuzuYmCMoehEWZg4cVzaS7Z6Znxj0sxjUSjJuwG3HxItVV1ZNyqruaqu7pSU7BBdmbg7%2Bg802yQV1kFzwJLtJZEAwIO55yMBf%2FgeKCN5lxcPQd6r1X31fw1ffeZ4f5BfGR0%2FMb7%2Bt9qRRdbdXd2tU7nnettimTfFgbdoKPg%2Ba1mhm82Q3q7mu1dwXr61Xf9VzXc73aujQi0sPVKQiZPuh69a5bb%2Fp1r9XE0Py%2Ft7kDSx3wwQV5EZJPlp84lyFZhSR%2BeEPYfqbTN96Jc0UzbTDgJx8k%2FUQXCeJFGRkHUXIyZ0Pbp%2BuPoZPjmVzowb%2FEUE6I8%2BNjhMnJXCTCwdFMZ6ggEoT8ORSDCkJVkLQC03ch%2BVMCMI6bW0ji%2Bze1KejePyidohOy%2FOwPyGJCln%2B9jCT%2BZk3JYe22VnkmdWIxjErIYQXZq5Dmp8j2lyCLU7DsU0j%2BM1l9tokkPtqySkPy81dZR7idlttaoWHTX2lGXmulG3b4SrvV7DZCt%2Bv5QXtmkJQVZFRBiRGovYTcOsilgzxykKcOYn5eY57ntV3OqNvpMtbgbREG3PVoO%2FKo5wYd5Gz6hxGydASmRmDmAKk5QF%2BOYPIfYHdLWO7AZgQDXqIQBIUlKChBIQmKjKAYlMdcWd%2BW97myeejNsz%2FPjXKss94hPdZZTyQE1IxgeHmYXpAXpgY6H33%2BE%2FrivNbqsJAy3nZ5yDvcZZT7Hg26QbfTEN2OELCyhLRLoNbBvpyQ9p87SOWEvLR2ByE9hVWnYNIBzV8GLUrQ3RL7ybeF1n0amRUdRZJJoepMx%2BC6RJotI9tzDtUFuTIb5cbWIwh2dv23xizATInUlPhEPiHoqXvjW7ogR7d0YcmjrTSTsdyn0zHfzmgmLn31ntgrtOEbN%2Bzoy7fYFJiWD3aEzTZpwmXSs%2BTrNcm5MOvaMEG%2B37AfinA7t7truUnydHP77fWNODXCWqmTCnS6sb8bMDkhz1%2FZmW3w1e%2B2IU0Fk5eI8zMyD0hdgaUHsOlCv9UERi04YeqgyMux8cPFpZIESix6Gpaw%2F%2BnDRT02dPqayvLQ3kPPLIFmd5HEJQamxECVoGoEm18aZ6k5u%2F7LXEaolsahMktHoTLqi5nN0%2BMhrDyvtRsNlwbdltduU9EOm34nCjxOqd8M%2FCCgDWR2Er3%2B1yt%2FAwAA%2F%2F8BAAD%2F%2Fwz%2BtmSbBAAA IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSQWskRRSuzuYmCMoehEWZg4cVzaS7Z6Znxj0sxjUSjJuwG3HxItVV1ZNyqruaqu7pSU7BBdmbg7%2Bg802yQV1kFzwJLtJZEAwIO55yMBf%2FgeKCN5lxcPQd6r1X31fw1ffeZ4f5BfGR0%2FMb7%2Bt9qRRdbdXd2tU7nnettimTfFgbdoKPg%2Ba1mhm82Q3q7mu1dwXr61Xf9VzXc73aujQi0sPVKQiZPuh69a5bb%2Fp1r9XE0Py%2Ft7kDSx3wwQV5EZJPlp84lyFZhSR%2BeEPYfqbTN96Jc0UzbTDgJx8k%2FUQXCeJFGRkHUXIyZ0Pbp%2BuPoZPjmVzowb%2FEUE6I8%2BNjhMnJXCTCwdFMZ6ggEoT8ORSDCkJVkLQC03ch%2BVMCMI6bW0ji%2Bze1KejePyidohOy%2FOwPyGJCln%2B9jCT%2BZk3JYe22VnkmdWIxjErIYQXZq5Dmp8j2lyCLU7DsU0j%2BM1l9tokkPtqySkPy81dZR7idlttaoWHTX2lGXmulG3b4SrvV7DZCt%2Bv5QXtmkJQVZFRBiRGovYTcOsilgzxykKcOYn5eY57ntV3OqNvpMtbgbREG3PVoO%2FKo5wYd5Gz6hxGydASmRmDmAKk5QF%2BOYPIfYHdLWO7AZgQDXqIQBIUlKChBIQmKjKAYlMdcWd%2BW97myeejNsz%2FPjXKss94hPdZZTyQE1IxgeHmYXpAXpgY6H33%2BE%2FrivNbqsJAy3nZ5yDvcZZT7Hg26QbfTEN2OELCyhLRLoNbBvpyQ9p87SOWEvLR2ByE9hVWnYNIBzV8GLUrQ3RL7ybeF1n0amRUdRZJJoepMx%2BC6RJotI9tzDtUFuTIb5cbWIwh2dv23xizATInUlPhEPiHoqXvjW7ogR7d0YcmjrTSTsdyn0zHfzmgmLn31ntgrtOEbN%2Bzoy7fYFJiWD3aEzTZpwmXSs%2BTrNcm5MOvaMEG%2B37AfinA7t7truUnydHP77fWNODXCWqmTCnS6sb8bMDkhz1%2FZmW3w1e%2B2IU0Fk5eI8zMyD0hdgaUHsOlCv9UERi04YeqgyMux8cPFpZIESix6Gpaw%2F%2BnDRT02dPqayvLQ3kPPLIFmd5HEJQamxECVoGoEm18aZ6k5u%2F7LXEaolsahMktHoTLqi5nN0%2BMhrDyvtRsNlwbdltduU9EOm34nCjxOqd8M%2FCCgDWR2Er3%2B1yt%2FAwAA%2F%2F8BAAD%2F%2Fwz%2BtmSbBAAA HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 23dce3d084b2d65a3185d09ea6f39b1f
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fstyle.css&l=3355&fd=41 | 192.243.59.20 | 200 OK | 0 B |
URL GET HTTP/1.1hewomenentail.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fstyle.css&l=3355&fd=41 IP192.243.59.20:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjecthewomenentail.com Fingerprint14:95:EE:C0:C1:31:B6:1C:62:FC:81:55:8C:9C:5B:64:48:FD:65:AD ValidityWed, 24 Apr 2024 15:13:32 GMT - Tue, 23 Jul 2024 15:13:31 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fssp%2Fvpn%2Fclassic-push%2Fsmall%2Fcss%2Fstyle.css&l=3355&fd=41 HTTP/1.1
Host: hewomenentail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Cookie: u_pl=22712266; uid_id2=c8e08505-ab42-4f15-9b8d-75493b091267:3:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:34 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| wookafr.cyou/api/v1/channel/meta.json?channelType=channel&restriction=&paginate=simple&loader=channelPage | 104.21.37.216 | 404 Not Found | 71 B |
URL GET HTTP/3wookafr.cyou/api/v1/channel/meta.json?channelType=channel&restriction=&paginate=simple&loader=channelPage IP104.21.37.216:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectwookafr.cyou FingerprintCF:72:70:FB:FF:12:C9:1A:DF:82:68:29:3C:32:FD:EF:57:22:1E:35 ValidityWed, 10 Apr 2024 19:01:20 GMT - Tue, 09 Jul 2024 19:01:19 GMT
File typeASCII text, with no line terminators Hashc5721382db5d701893533ac76518fa6f 09bebfcd83589a1c297c885de057096d99abb93d 108f0dd1304062ec4aa34dd1a9e548dffb628312e670b599aee04aaf12c0772e
GET /api/v1/channel/meta.json?channelType=channel&restriction=&paginate=simple&loader=channelPage HTTP/1.1
Host: wookafr.cyou
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-XSRF-TOKEN: eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0=
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/meta.json
Cookie: XSRF-TOKEN=eyJpdiI6IktoT2xFVFNwZGdBaGlHMlFFbHZnYlE9PSIsInZhbHVlIjoiby92UE9LYXVUZSsrMjJPYkc0TTlkdXpZTjN4OGVrMmtlVzlMNFNSYTU3YUk2NU1RbFZHdDFUdCtQWGM1bmF6U04zSFdOL0liWWRaeHM5RW1rZmJaVlhlaXNnczRIVENxQlZYb1hzR1JGUDMwekMxa3BSMEhuU2d3MTAvVmFybmkiLCJtYWMiOiJkN2Q5OTE4ZjE3M2NjMmRjNzAxODRkNGEyMTUxN2FkNjMxYTljYjYyMjdkZjk3MTk3Y2I2MTg3MjdhN2JjNGE0IiwidGFnIjoiIn0%3D; wookafr_session=eyJpdiI6Ikg3SFc3RnFTRk9BdTc4Z005ZXZualE9PSIsInZhbHVlIjoibUZ3SkhvRGFRTjRsNlRNWENNdGRkWW1jNDBIQXhoMWUrNWVoNDNyQkxTL2IwMitqaGdybjZTQ1A1YWVLOS90Z2VSL09lam92OEJjbDJvQ1NBdWVUdGRMYk9KMk90ajZPalNJdGlHUXA3WVQvRDQyQXppUmRhb00zWlVpSjNIUEUiLCJtYWMiOiJiNTExNDE3MGFmYTcyMTE1ZDY0MTZkYTI5OTE3ZTBkYzE0OWI2MTViZmU5OTlmNWE0YTQ4MTcyODIzNzJiOTk5IiwidGFnIjoiIn0%3D; _ga_5SMVWLEDQQ=GS1.1.1714157853.1.0.1714157853.0.0.0; _ga=GA1.1.2097473760.1714157853; dom3ic8zudi28v8lr6fgphwffqoz0j6c=21517c69-e912-448f-a155-153a8011e8a8%3A2%3A1; pp_main_e69be4c549af48660bae6788101a6810=1; pp_idelay_e69be4c549af48660bae6788101a6810=1; sb_main_58cbacd70dbd8d0cad21a696983e98ee=1; sb_count_58cbacd70dbd8d0cad21a696983e98ee=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: application/json
x-powered-by: PHP/8.2.18
cache-control: private, must-revalidate
x-ratelimit-limit: 1500
x-ratelimit-remaining: 1499
pragma: no-cache
expires: -1
access-control-allow-origin: *
vary: Accept-Encoding
set-cookie: XSRF-TOKEN=eyJpdiI6IjVVS0tGS3U0cmRpMlpyYXhZeG01RWc9PSIsInZhbHVlIjoiZVBjbHczVmNRdUsxdEVxMmZkU3JqbHE2dklScE5ndVdVRkpLeTREM3FIcHFKdHFIRFpMQzVXOWhuc3kvMFg4SUxyV3JabXdwOGEzSHZFdlU5TkR2Y2tqQWh1SVJFQkp2WGE4MHpHUVNxNkpXc2NlVDU3dkdIaGFWY2dRdDBCWU0iLCJtYWMiOiJiZDA2YTJiYjkxMmUzODJjYTZiYzMyY2EyOTNjYmI2MGMyYThkY2RmMDM4MDZlOGZmMWU1ZGEwNzEzN2NiMWRkIiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:34 GMT; Max-Age=7200; path=/; secure; samesite=lax
wookafr_session=eyJpdiI6Ik5vYWYwVmtiMzhhSGRJQ3JQa2h1a1E9PSIsInZhbHVlIjoiZ0RFbU9jQURFaUpmSEV4T2dLZytXdWZQOU1xenM4WEQ3dk95YnRoM0NDNU0rd0gydzJvUXIyRjhhNGJVNS9qRitEQzMzeDB2ZSs2dXcyQmIrRStwSHlQbjRUejdpT2JSZTM1S2RQeWZLeXU3S3A2eEJiRVRrMVlIanByN0JrYnEiLCJtYWMiOiJhMDFkNWZkMjkxYjFjOWM0ZGMwZTg0MjAxMDBiYWI0YmYxZjYwNDlhODUxMDJlZjk5NGMyNDYxOTkwMWIzMzI2IiwidGFnIjoiIn0%3D; expires=Fri, 26 Apr 2024 20:57:34 GMT; Max-Age=7200; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2FSyj7%2B8q91XkzIBw8ZfUA4pkSEI3NAa5%2B4Nq2MjG2GqOKDzsv%2BFNhNPi2plS%2BWj4AHF%2BEs1wFD%2F2jUaouToju1h2w5%2F6VfGHbcT71TdCCPfvjHkCUTQQK6iALaH81g%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a8cc99ec0fb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| ultimatumrelaxconvince.com/pixel/purst?dl=0&th=0&sc=0&rs=1504&rd=1504&fd=954&bv=24.4.6923&tmpl=70 | 192.243.59.13 | 200 OK | 0 B |
URL GET HTTP/1.1ultimatumrelaxconvince.com/pixel/purst?dl=0&th=0&sc=0&rs=1504&rd=1504&fd=954&bv=24.4.6923&tmpl=70 IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectultimatumrelaxconvince.com FingerprintED:7E:CD:40:05:B3:70:C3:C7:CF:3A:82:20:FE:24:2D:C6:55:33:F3 ValidityTue, 23 Apr 2024 10:50:54 GMT - Mon, 22 Jul 2024 10:50:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/purst?dl=0&th=0&sc=0&rs=1504&rd=1504&fd=954&bv=24.4.6923&tmpl=70 HTTP/1.1
Host: ultimatumrelaxconvince.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 18:57:33 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| cdn.cloudimagesb.com/si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png | 45.133.44.9 | 200 OK | 16 kB |
URL GET HTTP/2cdn.cloudimagesb.com/si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png IP45.133.44.9:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced Hash14cf262fabfd850855c42847d14fe775 2fafa28f167f018a0fb1f261f47380c8810803c9 972004ebada4077c3a4d03dcb45175ea467faf54da72be727a1c5c75e688b8af
GET /si/07/9c/1b/079c1b9b48633e3ef398faef0739f24f/1701651986.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: image/png
content-length: 16093
server: nginx/1.21.6
last-modified: Mon, 04 Dec 2023 01:06:35 GMT
etag: "656d261b-3edd"
expires: Sun, 28 Apr 2024 18:57:34 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap | 142.250.74.106 | 200 OK | 7.0 kB |
URL GET HTTP/3fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap IP142.250.74.106:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50 ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT
File typeASCII text, with very long lines (7193), with no line terminators Hash16b49a99486594c0b42d9bd7821deb2c 2fb46e5e86d6b37d4497cc04bfd89b3cb33a276a 3f3540952441e06ef81189cf63d46bac242804e386779dbb0cdd78ed10025c21
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 18:57:34 GMT
date: Fri, 26 Apr 2024 18:57:34 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap | 142.250.74.106 | 200 OK | 9.7 kB |
URL GET HTTP/2fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap IP142.250.74.106:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50 ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT
File typeASCII text, with very long lines (9908), with no line terminators Hash67a9083bdc18aa7e545cabdc090a7f0c 32391eac6657e2ccc158acbe12ac20e5beef02a8 f9ef9d10985348eadbc675e775c5b92e8611fe0b6e80aac0f11f21134894a6b9
GET /css2?family=Inter:wght@400;500;600;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 18:57:32 GMT
date: Fri, 26 Apr 2024 18:57:32 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js | 104.21.70.253 | 200 OK | 84 kB |
URL GET HTTP/3cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/jquery.min.js IP104.21.70.253:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeJavaScript source, ASCII text, with very long lines (32025) Hash4a356126b9573eb7bd1e9a7494737410 8258d046f17dd3c15a5d3984e1868b7b5d1db329 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
GET /sb/ssp/vpn/classic-push/small/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: application/javascript
last-modified: Fri, 19 Jan 2024 14:19:42 GMT
etag: W/"65aa84fe-1499c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 6241948
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=skebeIx7z99f3pYTtTRCcppInWke0LFDTUX1%2BwCOSX0%2BOP7xGQHavWkyTJnuNaJ60ec9bxAj%2Fn85DkD9rSzW12lO1bNBPpYIjfIZNNxd4cCPeq889jEGTS1YKh59jYW3fSNgB%2FO9Noit"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9ddd6056a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/script.js | 104.21.70.253 | 200 OK | 962 B |
URL GET HTTP/3cdn.creative-bars1.com/sb/ssp/vpn/classic-push/small/js/script.js IP104.21.70.253:443
Requested byhttps://wookafr.cyou/meta.json CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeASCII text, with very long lines (1015), with no line terminators Hash88523e22d10f0cbad31aa1d8276764fa 9238cd9499e01abdbeb33e68c550d26cfb6eaba5 d553390acb639c765cb6aaa4fbb72529e4005227d190f53108aec87ccec411c2
GET /sb/ssp/vpn/classic-push/small/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wookafr.cyou
DNT: 1
Connection: keep-alive
Referer: https://wookafr.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 18:57:34 GMT
content-type: application/javascript
last-modified: Fri, 19 Jan 2024 14:19:42 GMT
etag: W/"65aa84fe-3c2"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 109177
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=67m42wQ86dTM1t%2BG%2FdIQA%2BTGt0PfZ%2F6rfCRPQHLjPp%2B6PS1udt3zLxSk6a8anrdNZOZEwD%2FtwsUcYZyRCN7GccQg45s38ne0Dl6Y%2Bj9keHa5usTcF09kBdUhSVE5Bkc5rffRcRPQTQU3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a8cc9e1ddc56a5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
0.0.0.0