Report - needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW

Report Overview

Submitted URL
needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
IP
172.67.141.192
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-10 06:22:44
Access
public
Website Title
Better than dating
Final URL
needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
28

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pornhub.com	4903	2000-10-31	2012-05-22	2024-05-10	374 B	201 B	66.254.114.41
www.xvideos.com	11464	1997-12-30	2012-05-21	2024-02-12	380 B	41 kB	185.88.181.2
accounts.google.com	81	1997-09-15	2016-03-20	2024-05-09	1.8 kB	5.4 kB	74.125.131.84
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-05-10	406 B	2.8 kB	142.250.74.106
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-05-10	1.1 kB	98 kB	216.58.207.227
svntrk.com	105291	2018-04-18	2018-04-27	2024-05-01	378 B	49 kB	188.114.97.1
lh3.google.com	213	1997-09-15	2012-07-21	2024-05-09	432 B	505 B	142.250.74.110
needsscars.com	unknown	unknown	No data	No data	13 kB	202 kB	104.21.9.52
www.pornhub.com	10781	2000-10-31	2012-05-21	2024-05-10	766 B	94 kB	66.254.114.41
o.pki.goog	unknown	2016-06-13	2024-04-24	2024-05-09	650 B	1.4 kB	142.250.74.131

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed
2024-05-09	medium	needsscars.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	Size	First Seen	Last Seen
	needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW	0 B	2023-03-07	2024-05-20
Pretty URL needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW IP 104.21.9.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 17:51:18 Times Seen37884566 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	needsscars.com/landings/6/js/vendor.d9a61888c5cb3eca82df9ae29d53891b.js	95 kB	2023-05-14	2024-05-18
Pretty URL needsscars.com/landings/6/js/vendor.d9a61888c5cb3eca82df9ae29d53891b.js IP 104.21.9.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-14 10:49:20 Last Seen2024-05-18 23:24:55 Times Seen14 Hash 022376de858ddc57b55f4267408b9d0c ff62ede07a6cf74ce753a88a1f49ac5baffa7a9c bb6fbac37af57aaf3936dd30464a59b8a83ca7f63000a54652665afc59d6f7b3 Loading...

	needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW	0 B	2023-03-07	2024-05-20
Pretty URL needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW IP 104.21.9.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 17:51:18 Times Seen37884566 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	svntrk.com/assets/abl6_663dbd1b89e6f.js	0 B	2023-03-07	2024-05-20
Pretty URL svntrk.com/assets/abl6_663dbd1b89e6f.js IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 17:51:18 Times Seen37884566 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	needsscars.com/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js	40 kB	2023-04-05	2024-05-20
Pretty URL needsscars.com/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js IP 104.21.9.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 13:38:28 Last Seen2024-05-20 12:48:46 Times Seen2867 Hash 1d8ad98fe3471d1a74d485f9b4737bfc a1190f7bb41660f682d59e15c2606279da0792f7 9aa12d141f3c41629c83ac95bf3bebab2b33bca7f8f8988bf64b53b57c73714c Loading...

HTTP Transactions (28)

URL IP Response Size

needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW

104.21.9.52

200 OK

5.9 kB

URL User Request GET HTTP/2
needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
5.9 kB (5868 bytes)
Hash
93577d8bc7dc29f8aa26defeb807b15f
b576f39f13eb2d89a491cd70db67ed1544001c7c
63e71ec9b9ed3f41745297799544da97756e90bfd790928ad4a89a8fccb6480b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 10 May 2024 06:22:19 GMT
content-type: text/html; charset=UTF-8
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; expires=Fri, 10-May-2024 08:22:19 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; expires=Fri, 10-May-2024 08:22:19 GMT; Max-Age=7200; path=/; httponly; samesite=lax
SRVNAME=w2; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kKdsh0U40HysuOxS2xOzjof5mW3fp02hSj0ucGMMQjqNW4wyYRQTn5SS1R3yjszBk97hqbVHUMYjnV2aTmWotZihIjx8o5tCU0dy5vm%2Fc1vpL2YxOLnOaJxYMiu7jZyA9g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8817d588585f5687-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Open+Sans:400,600,800

142.250.74.106

200 OK

2.1 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Open+Sans:400,600,800
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
gzip compressed data, max compression
Size
2.1 kB (2134 bytes)
Hash
a3761b735f2899c4c326153adc1d4d89
7b839b98b4d7cfcc2590f8a01ded905fd7f990e0
1c52e69974f82f3b5a44e6988bb3095054e812f222330c267624db89ec573233

HTTP Headers

GET /css?family=Open+Sans:400,600,800 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 10 May 2024 06:22:19 GMT
date: Fri, 10 May 2024 06:22:19 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://needsscars.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 02:35:00 GMT
expires: Fri, 09 May 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 100040
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://needsscars.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 02:35:00 GMT
expires: Fri, 09 May 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 100040
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

svntrk.com/assets/abl6_663dbd1b89e6f.js

188.114.97.1

200 OK

48 kB

URL GET HTTP/2
svntrk.com/assets/abl6_663dbd1b89e6f.js
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerCloudflare, Inc.
Subjectsvntrk.com
Fingerprint83:5F:B1:05:69:64:18:2B:AF:21:B6:08:6A:BF:B6:F1:B5:95:C8:99
ValidityThu, 28 Dec 2023 00:00:00 GMT - Fri, 27 Dec 2024 23:59:59 GMT

File type
data
Size
48 kB (48237 bytes)
Hash
9313d54abf6a740543d419e0ceeadaa6
e3c8d3529683af315da6b40afd22a8d3ef730818
0401009ab60d239edd482dfcc7c2f3662f7a872b7ac0d2c0538631f94059e915

HTTP Headers

GET /assets/abl6_663dbd1b89e6f.js HTTP/1.1
Host: svntrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: BYPASS
set-cookie: svnimp=663dbd1c28489; path=/; secure; httponly; samesite=none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ZSCloc3%2B3Uv0n1aIPfWrjkum7j2do4uGrjYTwE8cmXKOCEc1wEaU8TQowW0BIIlHdW7f945RNhtntxmtv2U0ER5j8Cm8lpcgaHZmYbQ5cDOGPm3pP%2FiHFRK9tm4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d58e9ddc569d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

needsscars.com/favicon.ico

104.21.9.52

200 OK

0 B

URL GET HTTP/3
needsscars.com/favicon.ico
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/x-icon
content-length: 0
last-modified: Tue, 09 Apr 2024 11:06:20 GMT
etag: "6615212c-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 5033
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6YaYEiRmk7RvodBjBjRw9so0kOp6wXXLct4w%2BwaAFconvZojrHOaKBorEu5POrngfLFTJ5n4MAnMNZV9OYdbo8YudywNbE2ehnVlXowMaFNcyR1VOdcA58lLAf6loiNl0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d591afc0712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-3.jpg

104.21.9.52

200 OK

2.3 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-3.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.3 kB (2330 bytes)
Hash
6a5ea8cc8407168c63bbb49f327b6054
b6397e8e45e6a842924f901da12b66d47b9fca24
4bc65c25844c861b629b5b6cab44647369163b4b66bad4eae6695c8f76c055fb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-3.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2330
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-91a"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oCq1rzmE%2FYk1dc11LiYtjuez8I0%2FoQQXCQCfJs1ZdGsTlQNu8txlXUr7YVtIbQmiUehI2X2EitgfdYFijawfLD72prBr7jfrrQETSKj1vkJkKD5jWoWEf%2FGameb%2FpXsK7A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592d8e6712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/big-2.jpg

104.21.9.52

200 OK

31 kB

URL GET HTTP/3
needsscars.com/landings/6/image/big-2.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 497x713, components 3
Size
31 kB (31163 bytes)
Hash
0f6b3edd780fe3805880c4b612eb51f4
8059ff0b571a9438bd0f316c4de53d190e243b2d
266cf1c22b9f45c3fb5ac84f2a2132a34be2d34557a548fe515140c306847581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/big-2.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 31163
last-modified: Tue, 09 Apr 2024 11:06:22 GMT
etag: "6615212e-79bb"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4h8Z7Zg%2B%2BtvghFbqwvfe4pQ6KybJhXxUDUnxeXhg0Shw2xHrdFkbzjrzZpkOg5me47iuLBAbN%2BtDg07kuUS8Dsjt4w7Nr47Ff5tKmI8Bpdov0as5WoRt2R6SMhTfiE6PYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592c8e1712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-5.jpg

104.21.9.52

200 OK

2.6 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-5.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.6 kB (2558 bytes)
Hash
f09c6d545f2dc4f960156ee9a79ea643
a6a4c7f769357f09c5ac3d18e64623f8f3bb695e
3243e54fb9e8ce920df0ad80b62359175cea76682b9c19844d127ad596881593

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-5.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2558
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-9fe"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9yxpFtAuCpSDaiurWBbYOL1UuRRdIOcYDrpm4lbDZHbQNIjbwmTKxQUSPWeNcI1yN5HEEa1hG9Wn0YVNrJ5io0MxHBeTPGtUFx3Y0G5izt8X4%2FrmWaJyX8phdM29ohx1w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592c8e3712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-2.jpg

104.21.9.52

200 OK

2.8 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-2.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.8 kB (2815 bytes)
Hash
fa0ccc90f090f47721fdb5e4a5472947
abf92d28c0a1af0749081ca4fbd0bf841c9fb13b
116b82a0728854def12ebf65ef3cadd975738dfe0277ae96db2bf8be7bc3145a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-2.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2815
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-aff"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1711
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ev9Bg88XpFTBYQTrJA1CKeIPAUMyL3NBYIcjS3ZlH73JqGQ%2BuMiuwFzjEVcQ2njqmD%2BKVCfSAYgoGgv0%2BPC%2FU1ViUJAEWdUtZD4GD6OYw21%2BLJSzwV5RDaWVla%2BCjzL8sw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592d8f2712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-4.jpg

104.21.9.52

200 OK

3.1 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-4.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
3.1 kB (3141 bytes)
Hash
165e8f92260467de4a8d09e7dc8eb6fe
10ab316a2230fabe35f9f475676f2c4ffabe3194
91694ff8a668fb246ed129831e0a6c8db429888fa823d7d6be940d87cc4d089a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-4.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 3141
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-c45"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1SUNxJbvjWZlIjWerEkeGfd3lLbJBhWjMFtJd%2FZbvN7pl5DzzNiOAEUzqIyDn77B8%2FgoOv%2FDp3o12cf1UvIPlCCjw59aelhb3Uzqj0b6i%2BTUJNltyLtBhuwZoxJb0gZ2vw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592d8f4712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-7.jpg

104.21.9.52

200 OK

3.9 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-7.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
3.9 kB (3893 bytes)
Hash
4e109039c449a5deef98e075f2e965dd
35e7b7b2b3396a26c6249e969c3e61d2415a83ab
9a9165283265b3b4ad5757aaa9b2e8c47ff38c354f46e610f1efbd0fc3c7eb71

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-7.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 3893
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-f35"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2xBb40vme2KmJYGkqTqwdeTV7XfmvyvL%2FSnDxdagnbfC4Upjn6%2BUAb3xzZBjjNH8cglht6eT67hz7IoD4t9otO5HFEv%2BXcf%2BSIud670LewXH5eFIUV%2FP1PqBx3mpWRM7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592d8f5712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-8.jpg

104.21.9.52

200 OK

2.9 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-8.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.9 kB (2865 bytes)
Hash
54d1e71177e36e4da2e5424923081f0e
579c5794388df1ea5405266d31d9c3c2ee318716
e850c7769858e26dabe258f627aeef89399b2e1ba45bcbb9832823c43c33bf74

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-8.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2865
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-b31"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wju%2Bg5y8n%2F6du%2FJXq6J85gI%2BHtgHxkuGQDu05p5AXh%2BIpWapBoKo5rFIlMHrxL2yKqT9X9Qz7kWENlDzWTRDefp78flkapbZ75suphEhIxDc8uWN65hipC2gBWVuSMGnsw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592e8fe712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-1.jpg

104.21.9.52

200 OK

2.5 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-1.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.5 kB (2454 bytes)
Hash
2a1d01f3e21999d9bc0bdafbcb111e3a
1bd9791a89c0d9a0498ff068355d1d8b3b6faf12
5a7c89326cbd0bb61f9845b91c2e7f182bb0f8468db7612e79bb52db7fa7077b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-1.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2454
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: "6615211a-996"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1711
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hP1isTFoHUKnnId16EJYYlb9DbNvw99W4uGRdV%2FX3QlhXvFFq%2B%2FJVyY8fa1MOCK%2BYLm%2BHRUtuNUhmMsRM%2FZ91nFhMweLI9Ov%2FdIa%2BjeqgYmQotgi%2B5honaOMh5bRsslc0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592f90a712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/landings/6/image/photo-6.jpg

104.21.9.52

200 OK

2.7 kB

URL GET HTTP/3
needsscars.com/landings/6/image/photo-6.jpg
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 115x115, components 3
Size
2.7 kB (2711 bytes)
Hash
28959ec79a3530b90b1138f6efba1957
78ea99c17e9c670245adb56c5f3d66ab6c595556
a099c675c36ca3b9a48779b574da956b94bbd9a51c9f59c8934fd57c9644f367

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/image/photo-6.jpg HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:20 GMT
content-type: image/jpeg
content-length: 2711
last-modified: Tue, 09 Apr 2024 11:06:22 GMT
etag: "6615212e-a97"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1710
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xcQI5DAHu46k15EsmWg1VASZys%2FwVKo%2FYd7YgsXDEkYvfI875f3MnP%2BYz2Glob8ozUQlURwpJ%2FJ35%2BwzZnNDYZXGv4IrD0xKGgQYmrY1n0LbYfsTjU4LwznPJqq9dC52IQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d592f90d712f-OSL
alt-svc: h3=":443"; ma=86400

needsscars.com/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js

104.21.9.52

200 OK

27 kB

URL GET HTTP/3
needsscars.com/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (40096)
Size
27 kB (26971 bytes)
Hash
1d8ad98fe3471d1a74d485f9b4737bfc
a1190f7bb41660f682d59e15c2606279da0792f7
9aa12d141f3c41629c83ac95bf3bebab2b33bca7f8f8988bf64b53b57c73714c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 09 Apr 2024 11:06:03 GMT
etag: W/"6615211b-9ca8"
cache-control: max-age=14400
cf-cache-status: HIT
age: 400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8TrI4WCUBid74ipFG8HLqir1d2DMJt0lntns4a%2BKGQbuaxywB%2Bz%2Fp74mSgiasDzkVgBHw7AMJ9FjaebjA4JvMTkmrPpjA7tUr0X%2FLamJ8Z38Rbky2dOqnUpD%2FLkj1oRp1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d58e5cf5712f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

pornhub.com/video/manage?o=mr&t=pr2

66.254.114.41

0 B

URL GET
pornhub.com/video/manage?o=mr&t=pr2
IP
66.254.114.41:0
ASN
#29789 REFLECTED

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerDigiCert Inc
Subject*.pornhub.com
FingerprintD6:BD:14:72:10:1B:49:A3:2B:24:7E:E7:CF:F6:A0:38:5E:5A:3F:DE
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-length: 0
location: https://www.pornhub.com/video/manage?o=mr&t=pr2
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

www.xvideos.com/favorite/90902157/mk_1123

185.88.181.2

404 Not Found

38 kB

URL GET HTTP/1.1
www.xvideos.com/favorite/90902157/mk_1123
IP
185.88.181.2:443
ASN
#46652 SERVERSTACK-ASN

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerSectigo Limited
Subject*.xvideos.com
Fingerprint2C:4F:6C:92:E4:3F:3E:7B:FD:E2:28:A6:4C:76:4E:23:82:C0:B3:5B
ValiditySun, 21 Jan 2024 00:00:00 GMT - Mon, 27 Jan 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (19818)
Size
38 kB (38385 bytes)
Hash
13de40820a8f8a89e93efed1a59a80ab
9a54915d1a09a6329227871c3a721acb289a1158
94bc510f63c636b6d48867ff6dfd55d892c58731e491751a97cb2e74436c02c2

HTTP Headers

GET /favorite/90902157/mk_1123 HTTP/1.1
Host: www.xvideos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Fri, 10 May 2024 06:22:20 GMT
P3p: policyref="/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Accept-Ch: Viewport-Width, Width, Device-Memory, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness
Vary: Accept-Encoding,User-Agent,Accept-Language,Cookie
X-Frame-Options: SAMEORIGIN
Report-To: {"group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "https://www.xvideos.com/csp-reports" } ] }
Content-Security-Policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com 1868565294.rsc.cdn77.org static.cloudflareinsights.com www.google.com www.gstatic.com fonts.gstatic.com fonts.googleapis.com ajax.googleapis.com fcm.googleapis.com accounts.google.com *.cdn77.org  *.nk-img.com  *.segpay.com  *.online-metrix.net *.vscdns.com *.vsmvideo.com www.tjk-njk.com *.orbsrv.com *.opoxv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.tf4srv.com *.aacdn.net *.adglare.net www.flirt4free.com www.ohmybutt.com www.secretpartners.com *.asf4f.us *.livejasmin.com *.jsmcrptjmp.com *.awemwh.com etahub.com ctrack.trafficjunky.net tracking.sexcash.com *.gtflixtv.com wss://*.1ka.com https://*.1ka.com https://media.1ka.com https://u.1ka.com https://n.1ka.com;img-src 'self' 'unsafe-inline' data: blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com *.cdn77.org www.google.com www.google-analytics.com ssl.gstatic.com *.nk-img.com *.camster.com data-cdn.pornbiz.com *.vscdns.com *.vsmvideo.com *.doubleclick.net *.google.fr *.google.com *.segpay.com *.online-metrix.net cdn.asf4f.us *.gtflixtv.com *.1ka.com *.orbsrv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.justservingfiles.net *.tf4srv.com *.aacdn.net *.rtbsuperhub.com; report-uri https://www.xvideos.com/csp-reports; report-to csp-endpoint
Referrer-Policy: no-referrer-when-downgrade
X-Robots-Tag: noindex
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: nginx

www.pornhub.com/video/manage?o=mr&t=pr2

66.254.114.41

337 B

URL GET
www.pornhub.com/video/manage?o=mr&t=pr2
IP
66.254.114.41:0
ASN
#29789 REFLECTED

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerDigiCert Inc
Subject*.pornhub.com
FingerprintD6:BD:14:72:10:1B:49:A3:2B:24:7E:E7:CF:F6:A0:38:5E:5A:3F:DE
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
337 B (337 bytes)
Hash
66a43eafe19fd2e9782007272dd06ced
9d5112f8b4482ef224d10b0d0a17bfaf053e8e23
f432da756645f1aa0bdfff17c86556d7343c5ae482f941597552d9701560d6bb

HTTP Headers

GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
server: openresty
date: Fri, 10 May 2024 06:22:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: platform=pc; expires=Fri, 17-May-2024 06:22:20 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
ss=846232241760964084; expires=Sat, 10-May-2025 06:22:20 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=34961.100000; expires=Sun, 09-Jun-2024 06:22:20 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=663DBD1C-42FE722901BB2BCC1D-2F22E947; Secure; Samesite=None
__l=663DBD1C-42FE722901BB2BCC1D-2F22E947; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
ph-redirect: 1041
location: /login
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

o.pki.goog/wr2

142.250.74.131

471 B

URL
o.pki.goog/wr2
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
9a42e37278e1480da7ec417eb8b7285e
2ebb273a9d30622c0371647e60d4323937a9d5bc
0c3686dcbc184d61e8fd14b50520a7d83880a655fa38a7f14443a275130a446e

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 10 May 2024 06:22:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en

74.125.131.84

302 Found

0 B

URL GET HTTP/2
accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en
IP
74.125.131.84:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint75:65:5E:EB:A9:59:16:DF:32:A3:39:DC:8A:A2:FD:28:92:33:6B:0D
ValidityTue, 16 Apr 2024 04:20:43 GMT - Tue, 09 Jul 2024 04:20:42 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:nPphoJMaiRHuqAXF_Nx5zBHrjck-4w:u6N-2MJWx74Cv5Lz; Expires=Sun, 10-May-2026 06:22:21 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 May 2024 06:22:21 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQwNfhgwWy3yKkPbsGIvciOmygA1fFzLiMmVGP7bcDruGVnWDsYSQHZIJUcGJHxcXZLCFhlkPA
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-bAorJVWyG46inomGNZu9TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQwNfhgwWy3yKkPbsGIvciOmygA1fFzLiMmVGP7bcDruGVnWDsYSQHZIJUcGJHxcXZLCFhlkPA

74.125.131.84

302 Found

442 B

URL GET HTTP/2
accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQwNfhgwWy3yKkPbsGIvciOmygA1fFzLiMmVGP7bcDruGVnWDsYSQHZIJUcGJHxcXZLCFhlkPA
IP
74.125.131.84:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint75:65:5E:EB:A9:59:16:DF:32:A3:39:DC:8A:A2:FD:28:92:33:6B:0D
ValidityTue, 16 Apr 2024 04:20:43 GMT - Tue, 09 Jul 2024 04:20:42 GMT

File type
HTML document, ASCII text, with very long lines (410)
Size
442 B (442 bytes)
Hash
812a5d769b3693d94cfa38babf728175
b55d27512a42df006bb54921a7b1cd62034b5e4a
714c02546d0cbfcc564296962314f8fc6fb817a9fc393974bd8d53b76292f036

HTTP Headers

GET /InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQwNfhgwWy3yKkPbsGIvciOmygA1fFzLiMmVGP7bcDruGVnWDsYSQHZIJUcGJHxcXZLCFhlkPA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:UKaZB63QwLRew27R_xGwj8mnpEvpxA:tf71YZV-N4033GQr;Path=/;Expires=Sun, 10-May-2026 06:22:21 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 May 2024 06:22:21 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Flh3.google.com%2Fu%2F0%2Fd%2F1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQx0ig1HQBr12BXuadRvP5lKSDzbUVtpquHqb8sG3W98ZcxEZ8RBGXiBjKU83LIledNsro1vTg&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1006320522%3A1715322141398911&theme=mn&ddm=0
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-security-policy: script-src 'nonce-zzEMlh8LgIbzrq1Y3-LRuA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 442
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

o.pki.goog/wr2

142.250.74.131

471 B

URL
o.pki.goog/wr2
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
4addd78a1ebbfbfd98f962bee30de93e
113326456169ddeb584e9bc96365d93c913e40be
5aabd865e6cf2769f401a6bb4b0059dcf57bc7b5e0cc8e015a2fe0e0d85d9717

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 10 May 2024 06:22:21 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.pornhub.com/login

66.254.114.41

90 kB

URL GET
www.pornhub.com/login
IP
66.254.114.41:0
ASN
#29789 REFLECTED

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerDigiCert Inc
Subject*.pornhub.com
FingerprintD6:BD:14:72:10:1B:49:A3:2B:24:7E:E7:CF:F6:A0:38:5E:5A:3F:DE
ValidityMon, 15 Jan 2024 00:00:00 GMT - Fri, 14 Feb 2025 23:59:59 GMT

File type
gzip compressed data, max speed, from Unix
Size
90 kB (89976 bytes)
Hash
1f1ab0ee548ea21fbe4cdb82dd3219c0
f9c0bd95ec86ac4cadb04fbc783f358298e69e86
a6571b73bb60b9ab5b5aa952d1643323022d198fdf866b4120d88a5539fa1ea3

HTTP Headers

GET /login HTTP/1.1
Host: www.pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty
date: Fri, 10 May 2024 06:22:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: platform=pc; expires=Fri, 17-May-2024 06:22:20 GMT; Max-Age=604800; path=/; domain=pornhub.com; secure
ss=243154840594320574; expires=Sat, 10-May-2025 06:22:20 GMT; Max-Age=31536000; path=/; domain=pornhub.com; secure
fg_0d2ec4cbd943df07ec161982a603817e=39901.100000; expires=Sun, 09-Jun-2024 06:22:20 GMT; Max-Age=2592000; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__s=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=www.pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=pornhub.com; secure
__l=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure
__s=663DBD1C-42FE722901BB2BCC1D-2F22E9CB; Secure; Samesite=None
__l=663DBD1C-42FE722901BB2BCC1D-2F22E9CB; Secure; Samesite=None; Max-Age=31556926
x-frame-options: SAMEORIGIN
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
vary: User-Agent
rating: RTA-5042-1996-1400-1577-RTA
content-encoding: gzip
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

needsscars.com/landings/6/fonts/vendor.f180d92f7ba8934353ddaa138f23dc11.css

104.21.9.52

200 OK

9.6 kB

URL GET HTTP/3
needsscars.com/landings/6/fonts/vendor.f180d92f7ba8934353ddaa138f23dc11.css
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type
ASCII text, with very long lines (9561), with no line terminators
Size
9.6 kB (9558 bytes)
Hash
4a4ade5e36d98f452d34b2fd675adae4
07fd7eaac7db96eb73b54e9449998b76b83a9bd7
9a62cd32d0595af501f8b6760d6bd7a22167da60b1cb730a052144bee57cea1a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/fonts/vendor.f180d92f7ba8934353ddaa138f23dc11.css HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:19 GMT
content-type: text/css
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: W/"6615211a-2556"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1712
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cy7hhgBK7SLVLHVPkhzKjZJXxHDZ4DGW4MSPtSNyGTmAeOdSgmIMy6Y74jEmeLOtJlksqJ7LjD%2F0QKrm8w3qpMAHegmZ2Zwoit4eIxwy5m0c%2BkoXvDBShKw2PnklU4pQiw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d58e5cf7712f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Flh3.google.com%2Fu%2F0%2Fd%2F1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQx0ig1HQBr12BXuadRvP5lKSDzbUVtpquHqb8sG3W98ZcxEZ8RBGXiBjKU83LIledNsro1vTg&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1006320522%3A1715322141398911&theme=mn&ddm=0

74.125.131.84

403 Forbidden

0 B

URL GET HTTP/2
accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Flh3.google.com%2Fu%2F0%2Fd%2F1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQx0ig1HQBr12BXuadRvP5lKSDzbUVtpquHqb8sG3W98ZcxEZ8RBGXiBjKU83LIledNsro1vTg&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1006320522%3A1715322141398911&theme=mn&ddm=0
IP
74.125.131.84:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint75:65:5E:EB:A9:59:16:DF:32:A3:39:DC:8A:A2:FD:28:92:33:6B:0D
ValidityTue, 16 Apr 2024 04:20:43 GMT - Tue, 09 Jul 2024 04:20:42 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /v3/signin/identifier?continue=https%3A%2F%2Flh3.google.com%2Fu%2F0%2Fd%2F1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQx0ig1HQBr12BXuadRvP5lKSDzbUVtpquHqb8sG3W98ZcxEZ8RBGXiBjKU83LIledNsro1vTg&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1006320522%3A1715322141398911&theme=mn&ddm=0 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 May 2024 06:22:21 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
content-security-policy: script-src 'nonce-FTn-dOSPuNsCl_Nz30XVhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

needsscars.com/landings/6/js/vendor.d9a61888c5cb3eca82df9ae29d53891b.js

104.21.9.52

200 OK

95 kB

URL GET HTTP/3
needsscars.com/landings/6/js/vendor.d9a61888c5cb3eca82df9ae29d53891b.js
IP
104.21.9.52:443
ASN
#13335 CLOUDFLARENET

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subjectneedsscars.com
Fingerprint2C:DB:7F:FC:42:54:75:BD:CB:A5:AF:A1:BD:39:24:6B:2A:B0:F1:91
ValidityWed, 08 May 2024 00:28:06 GMT - Tue, 06 Aug 2024 00:28:05 GMT

File type

Size
95 kB (95343 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/6/js/vendor.d9a61888c5cb3eca82df9ae29d53891b.js HTTP/1.1
Host: needsscars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImV4UFluWGp4VnIyUVM4ZWdLNWlDcXc9PSIsInZhbHVlIjoiZklwc24vRGxBUDVjZkJ1c3VJRi8xdXhvWWQxc2M2VFFxSkV3WDZDeUdUMEI2Y0RxRW9sekEyYWlobE8xcHdvcyIsIm1hYyI6ImE2NDMyNjIyNDg0NzNhZWYzNzRjOGQ1NjM1ZmY2NzUwNmZlM2RmMTkxM2Q1NzM0MjczOGM4YjVkMjFiOWU2MGMifQ%3D%3D; laravel_session=eyJpdiI6ImNFcTlCYmlNckZVckRCbE9kajNwZUE9PSIsInZhbHVlIjoiMHZSQjRKMXowZG5nUTNhUzVTdWNKQzdJOEJpQ0ViSlhXdUZIekdOMlc2TEt5WmNyaWh6NEQzRTdhcVNPN2JxdyIsIm1hYyI6IjAyZThmZDZlN2JlMGUwZGMxMjE1NWJmZTVkMjdmMGY0MGJmOWQyMTUyODI3MjI1MTFkYTEyZjU3MDU3MTE5N2MifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 10 May 2024 06:22:19 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 09 Apr 2024 11:06:02 GMT
etag: W/"6615211a-1746f"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1711
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hqsc64jaDp2lufd4ioNM7aCDb0nciRdqF7r2uqgH9tK9r3O5NwToXFmq5ijUF1S165yS7t2oX0eqd1ZxWfn5WVa6JjVncpPP8Zi5sB5lRqx6lfyQZKi0LBVXU5wXjwLyTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8817d58e5cf9712f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100

142.250.74.110

302 Found

0 B

URL GET HTTP/2
lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100
IP
142.250.74.110:443
ASN
#15169 GOOGLE

Requested by
https://needsscars.com/?s1=abl6&s5=N59aIN608yfJEGhq68dm6xqPW
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint7C:B7:E1:97:03:6E:82:B6:52:F8:EC:C6:C6:50:D9:DD:80:47:E6:A0
ValidityTue, 16 Apr 2024 03:18:53 GMT - Tue, 09 Jul 2024 03:18:52 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100 HTTP/1.1
Host: lh3.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
location: https://accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en
cache-control: private
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 10 May 2024 06:22:21 GMT
server: fife
content-length: 337
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (28)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers