Report - playx-1xbet635.ru/

Report Overview

Submitted URL
playx-1xbet635.ru/
IP
185.196.8.72
ASN
#42624 Simple Carrier LLC
Submitted
2024-04-18 12:14:33
Access
public
Website Title
1XBET полная версия сайта | 1XBET вход через зеркало
Final URL
better-pharm.ru/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
1
Threat Detection Systems
42

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.better-pharm.ru	unknown	unknown	No data	No data	462 B	7.7 kB	185.196.8.72
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-18	476 B	7.6 kB	142.250.74.106
playx-1xbet635.ru	unknown	unknown	No data	No data	472 B	360 B	185.196.8.72
better-pharm.ru	unknown	unknown	No data	No data	10 kB	1.0 MB	185.196.8.72
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-18	2.1 kB	54 kB	142.250.74.163

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-18 12:14:07	medium	185.196.8.72	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 32

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed
2024-04-18	medium	better-pharm.ru	Sinkholed

ThreatFox

No alerts detected

JavaScript (8)

	URL	Size	First Seen	Last Seen
	better-pharm.ru/	3.2 kB	2024-04-18	2024-04-18
Pretty URL better-pharm.ru/ IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 14:14:41 Last Seen2024-04-18 14:14:41 Times Seen1 Hash 4f55bd4c2694dd73cfa1d3f3df82657b 7d230e93ead2347be3dc48b0a6752bc60691469b 1fd72fd4f9ff14b7961c02b26a971baf288cfc1a42c1a96ea3ac5be20bb3778e Loading...

	better-pharm.ru/wp-includes/js/jquery/jquery.min.js	88 kB	2023-11-03	2024-05-01
Pretty URL better-pharm.ru/wp-includes/js/jquery/jquery.min.js IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-03 09:26:43 Last Seen2024-05-01 20:47:00 Times Seen43277 Hash 826eb77e86b02ab7724fe3d0141ff87c 79cd3587d565afe290076a8d36c31c305a573d18 cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Loading...

	better-pharm.ru/wp-includes/js/jquery/jquery-migrate.min.js	14 kB	2023-05-09	2024-05-01
Pretty URL better-pharm.ru/wp-includes/js/jquery/jquery-migrate.min.js IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-09 19:21:05 Last Seen2024-05-01 20:43:35 Times Seen81761 Hash 9ffeb32e2d9efbf8f70caabded242267 3ad0c10e501ac2a9bfa18f9cd7e700219b378738 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Loading...

	better-pharm.ru/	240 B	2024-04-18	2024-04-18
Pretty URL better-pharm.ru/ IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 14:14:41 Last Seen2024-04-18 14:14:41 Times Seen1 Hash 2f714dfd35c2e36d7ebebd3555bd3f6e c2b0742e4440e2635f0766fc18faef1d61c99a88 c1a1489c435555aaca2c8c642475705a0f007db6f37aca753444aa4831594fb1 Loading...

	better-pharm.ru/wp-content/themes/root/assets/js/scripts.min.js	7.5 kB	2023-03-07	2024-04-30
Pretty URL better-pharm.ru/wp-content/themes/root/assets/js/scripts.min.js IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:23:38 Last Seen2024-04-30 17:25:53 Times Seen287 Hash 7a831dfa599fe582456e82d4f3861ed1 8dbbc7c71cfc6ff61cfc870d8ed06b45c2794d56 68babdfc4950d6f622a966498dbe69a5d2c99665f0388af533848f4f7c165cb4 Loading...

	better-pharm.ru/	230 B	2024-01-22	2024-04-30
Pretty URL better-pharm.ru/ IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2024-01-22 05:08:27 Last Seen2024-04-30 17:25:53 Times Seen10 Hash da7b909f84bcacb33db605858dff8e83 1f1ef876ec4d22dc81e28aa92a512857b93d81aa e7d1e38cd8005616feb48d7f1ad093db564e9d63e6b21b1996a953bd0d16aa08 Loading...

	better-pharm.ru/wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js	23 kB	2023-03-08	2024-05-01
Pretty URL better-pharm.ru/wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 14:35:53 Last Seen2024-05-01 07:58:00 Times Seen1441 Hash 63fad256b41b5d84bc1e86461a96a318 20d44c76509b9fb61a6e005112d60a1f3b73b8ec a69c12ccd186a899db79fce802b46c08e71f69c2c422be2666ed8565e3add026 Loading...

	better-pharm.ru/	451 B	2024-04-18	2024-04-18
Pretty URL better-pharm.ru/ IP 185.196.8.72 ASN #42624 Simple Carrier LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 14:14:42 Last Seen2024-04-18 14:14:42 Times Seen1 Hash a2daf115573989548ca7597ce42ad4d9 dd6e0ec53b1ce26e5a865f231f8149fd3310cba7 18684bb47f54784784d9030e86904e40c16395dda9a9c530a3b31b1ea4eb0bcd Loading...

HTTP Transactions (27)

URL IP Response Size

playx-1xbet635.ru/

185.196.8.72

301 Moved Permanently

169 B

URL User Request GET HTTP/2
playx-1xbet635.ru/
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Certificate
IssuerLet's Encrypt
Subjectplayx-1xbet635.ru
Fingerprint2D:DA:79:3D:AE:65:24:02:E7:9A:36:97:78:92:D4:6A:C8:CA:89:18
ValidityThu, 21 Mar 2024 22:58:28 GMT - Wed, 19 Jun 2024 22:58:27 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
169 B (169 bytes)
Hash
0f952b73d3f5586637ea9a5a789d48f4
b29aff4ffa1d4decd77db5160f920e1c6417e5e9
69d11528ee32902d0c47ed215877f0610399536f755db03ed02a77ecedd74751

HTTP Headers

GET / HTTP/1.1
Host: playx-1xbet635.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:07 GMT
content-type: text/html
content-length: 169
location: https://better-pharm.ru/
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/1xbet-%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F.png

185.196.8.72

200 OK

5.1 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/1xbet-%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 898 x 276, 8-bit colormap, non-interlaced
Size
5.1 kB (5104 bytes)
Hash
e2e5e56bb232f1a41bfc19daf7096d44
2667e6e7f433f37da52e36f1d838e544b65c7b1e
9912e33041f739bb2b6ec5a1441f3fff2f718b537c1127831dd1eb1d7efbd72a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/1xbet-%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 5104
etag: "5f05d9e6-13f0"
expires: Fri, 19 Apr 2024 00:14:07 GMT
accept-ranges: bytes
cache-control: max-age=43200
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/1xbet-%D0%B2%D1%85%D0%BE%D0%B4-%D0%B2-%D0%BB%D0%B8%D1%87%D0%BD%D1%8B%D0%B9-%D0%BA%D0%B0%D0%B1%D0%B8%D0%BD%D0%B5%D1%82.png

185.196.8.72

200 OK

3.3 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/1xbet-%D0%B2%D1%85%D0%BE%D0%B4-%D0%B2-%D0%BB%D0%B8%D1%87%D0%BD%D1%8B%D0%B9-%D0%BA%D0%B0%D0%B1%D0%B8%D0%BD%D0%B5%D1%82.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 672 x 209, 8-bit colormap, non-interlaced
Size
3.3 kB (3275 bytes)
Hash
fa72d493b5809eb300f29c88de78d0d2
63efc9468608f58df3e164dee2f53a76a7888e61
0c04e6718b797872bb28debe80ffa2b6284f003b0c2b3614bb0eec1370da5718

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/1xbet-%D0%B2%D1%85%D0%BE%D0%B4-%D0%B2-%D0%BB%D0%B8%D1%87%D0%BD%D1%8B%D0%B9-%D0%BA%D0%B0%D0%B1%D0%B8%D0%BD%D0%B5%D1%82.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 3275
etag: "5f05d9e5-ccb"
expires: Fri, 19 Apr 2024 00:14:07 GMT
accept-ranges: bytes
cache-control: max-age=43200
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/%D0%9F%D1%80%D0%BE%D0%BC%D0%BE%D0%BA%D0%BE%D0%B4-1xbet-%D0%BD%D0%B0-%D0%B4%D0%B5%D0%BD%D1%8C-%D1%80%D0%BE%D0%B6%D0%B4%D0%B5%D0%BD%D0%B8%D0%B5-768x263.jpg

185.196.8.72

200 OK

30 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/%D0%9F%D1%80%D0%BE%D0%BC%D0%BE%D0%BA%D0%BE%D0%B4-1xbet-%D0%BD%D0%B0-%D0%B4%D0%B5%D0%BD%D1%8C-%D1%80%D0%BE%D0%B6%D0%B4%D0%B5%D0%BD%D0%B8%D0%B5-768x263.jpg
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 768x263, components 3
Size
30 kB (29813 bytes)
Hash
b91edf3474ea23558c4ecb5ec53d3593
5942c7c947fd94e32c7c7beda358dd2822290add
fade5ad3a9a66a97b71739b9cfbb51cae473ece8f5e0d5c59b00489248182d38

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/%D0%9F%D1%80%D0%BE%D0%BC%D0%BE%D0%BA%D0%BE%D0%B4-1xbet-%D0%BD%D0%B0-%D0%B4%D0%B5%D0%BD%D1%8C-%D1%80%D0%BE%D0%B6%D0%B4%D0%B5%D0%BD%D0%B8%D0%B5-768x263.jpg HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/jpeg
content-length: 29813
etag: "5f05d9e5-7475"
expires: Fri, 19 Apr 2024 00:14:06 GMT
accept-ranges: bytes
cache-control: max-age=43200, s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/1Xbet-%E2%80%94-%D0%B7%D0%B5%D1%80%D0%BA%D0%B0%D0%BB%D0%BE-%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD-%D0%B3%D0%BE%D1%80%D1%8F%D1%87%D0%B5%D0%B9-%D0%BB%D0%B8%D0%BD%D0%B8%D0%B8.png

185.196.8.72

200 OK

18 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/1Xbet-%E2%80%94-%D0%B7%D0%B5%D1%80%D0%BA%D0%B0%D0%BB%D0%BE-%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD-%D0%B3%D0%BE%D1%80%D1%8F%D1%87%D0%B5%D0%B9-%D0%BB%D0%B8%D0%BD%D0%B8%D0%B8.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 452 x 138, 8-bit/color RGBA, non-interlaced
Size
18 kB (17807 bytes)
Hash
5c62a8c5c82ba199052ba67a1bb59d07
6b329bebacbe642fe487226832f24fe267618b0a
51d8f244f3a14e619bf00a52a62120aa638da457909d0b730bfa03985f089a30

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/1Xbet-%E2%80%94-%D0%B7%D0%B5%D1%80%D0%BA%D0%B0%D0%BB%D0%BE-%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD-%D0%B3%D0%BE%D1%80%D1%8F%D1%87%D0%B5%D0%B9-%D0%BB%D0%B8%D0%BD%D0%B8%D0%B8.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 17807
etag: "5f05d9e5-458f"
expires: Fri, 19 Apr 2024 00:14:07 GMT
accept-ranges: bytes
cache-control: max-age=43200, s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/05/1xbet-%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9-%D1%81%D0%B0%D0%B9%D1%82-2.jpg

185.196.8.72

200 OK

54 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/05/1xbet-%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9-%D1%81%D0%B0%D0%B9%D1%82-2.jpg
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=2, orientation=upper-left], baseline, precision 8, 898x436, components 3
Size
54 kB (54512 bytes)
Hash
583f689d42ffadb9e3388b1d82362ce7
5a62798276cdfe404d88b4a92ee36a4926d8336c
e7f3592bbe461a72728aead489a6e0f62e6e62a5b87e7505fe04580dc3863f9f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/05/1xbet-%D0%BE%D1%84%D0%B8%D1%86%D0%B8%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9-%D1%81%D0%B0%D0%B9%D1%82-2.jpg HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/jpeg
content-length: 54512
etag: "5f05d9e5-d4f0"
expires: Fri, 19 Apr 2024 00:14:06 GMT
accept-ranges: bytes
cache-control: max-age=43200, s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F-1xbet-%D0%B2-%D0%BE%D0%B4%D0%B8%D0%BD-%D0%BA%D0%BB%D0%B8%D0%BA.png

185.196.8.72

200 OK

56 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F-1xbet-%D0%B2-%D0%BE%D0%B4%D0%B8%D0%BD-%D0%BA%D0%BB%D0%B8%D0%BA.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 768 x 339, 8-bit/color RGBA, non-interlaced
Size
56 kB (56122 bytes)
Hash
59e8ad6ce574bb1e04529c28b013a095
f9b2d20711756e05b5757a366bd134154d7d6782
e96bad4ffa4e50f774d06769086ec5e78a25d2857bf17ba10af4eb4fdef806b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%86%D0%B8%D1%8F-1xbet-%D0%B2-%D0%BE%D0%B4%D0%B8%D0%BD-%D0%BA%D0%BB%D0%B8%D0%BA.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 56122
etag: "5f05d9e5-db3a"
expires: Fri, 19 Apr 2024 00:14:07 GMT
accept-ranges: bytes
cache-control: max-age=43200, s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/header.png

185.196.8.72

200 OK

86 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/header.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 2880 x 188, 8-bit/color RGBA, non-interlaced
Size
86 kB (86294 bytes)
Hash
4f5c3380e3e1f821822d775bff8074e2
dd7d87ec3e5fc3fdaf2c934afc9a8c51a4c776e6
2044d14610a09247cd32cf33b8f345bf15d38a269bc0184f85d5b7cae1b53589

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/header.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 86294
last-modified: Wed, 08 Jul 2020 14:36:22 GMT
etag: "5f05d9e6-15116"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
accept-ranges: bytes
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/themes/root/assets/js/scripts.min.js

185.196.8.72

200 OK

12 kB

URL GET HTTP/2
better-pharm.ru/wp-content/themes/root/assets/js/scripts.min.js
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
gzip compressed data, from Unix
Size
12 kB (11993 bytes)
Hash
f52830b02daba524503610e6162d877d
6132d09a1306cf934c813f6cae3d5dbf8864069d
ce63f1f5dbccaddf29c5da42a85e6db6bdb02055ff446d69aba0e18d353e1bc2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/themes/root/assets/js/scripts.min.js HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: application/javascript
last-modified: Tue, 30 Aug 2022 13:13:15 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"630e0ceb-1d5e"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/themes/root/fonts/fontawesome-webfont.ttf

185.196.8.72

200 OK

166 kB

URL GET HTTP/2
better-pharm.ru/wp-content/themes/root/fonts/fontawesome-webfont.ttf
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
TrueType Font data, 13 tables, 1st "FFTM", 24 names, Macintosh
Size
166 kB (165548 bytes)
Hash
b06871f281fee6b241d60582ae9369b9
13b1eab65a983c7a73bc7997c479d66943f7c6cb
aa58f33f239a0fb02f5c7a6c45c043d7a9ac9a093335806694ecd6d4edc0d6a8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/themes/root/fonts/fontawesome-webfont.ttf HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://better-pharm.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: application/font-sfnt
content-length: 165548
last-modified: Tue, 30 Aug 2022 13:13:15 GMT
etag: "286ac-5e77524a6de16"
accept-ranges: bytes
cache-control: s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js

185.196.8.72

200 OK

5.9 kB

URL GET HTTP/2
better-pharm.ru/wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
gzip compressed data, from Unix
Size
5.9 kB (5931 bytes)
Hash
4236c0fe3b434eb0d8742f1a429bc74b
57067879757ed7600e7efceeaafed5cd295e28dd
c243311b850ea4210369883990c631d68cb2fdbee2885da98c9fbebd0e1d29d8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/plugins/q2w3-fixed-widget/js/frontend.min.js HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: application/javascript
last-modified: Mon, 16 Jan 2023 11:11:22 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"63c530da-5b89"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

142.250.74.163

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://better-pharm.ru/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Size
16 kB (15744 bytes)
Hash
15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

HTTP Headers

GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://better-pharm.ru
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 02:37:01 GMT
expires: Fri, 18 Apr 2025 02:37:01 GMT
cache-control: public, max-age=31536000
age: 34627
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

142.250.74.163

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://better-pharm.ru/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
Size
16 kB (15860 bytes)
Hash
e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://better-pharm.ru
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 16 Apr 2024 10:46:32 GMT
expires: Wed, 16 Apr 2025 10:46:32 GMT
cache-control: public, max-age=31536000
age: 178056
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

142.250.74.163

200 OK

9.6 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://better-pharm.ru/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 9644, version 1.0
Size
9.6 kB (9644 bytes)
Hash
6f112ec2b932ee12379442c42853244e
b2e73c8c70d6261e1d187f41693c43ac4fe0809d
6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://better-pharm.ru
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9644
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 02:34:37 GMT
expires: Fri, 18 Apr 2025 02:34:37 GMT
cache-control: public, max-age=31536000
age: 34771
last-modified: Wed, 11 May 2022 19:24:50 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2

142.250.74.163

200 OK

9.6 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
IP
142.250.74.163:443
ASN
#15169 GOOGLE

Requested by
https://better-pharm.ru/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 9628, version 1.0
Size
9.6 kB (9628 bytes)
Hash
d9ac47c7e500fb7083b8d595eaf6fe12
112a2fc5f4ff9b85ee3a706fa9b8c47f79b05933
495d38d4b9741e8aa4204002414069e2d8db9f3c60b60e195e4d74381462dee9

HTTP Headers

GET /s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://better-pharm.ru
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9628
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 18 Apr 2024 02:37:03 GMT
expires: Fri, 18 Apr 2025 02:37:03 GMT
cache-control: public, max-age=31536000
age: 34625
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

www.better-pharm.ru/wp-content/uploads/2020/01/fon.png

185.196.8.72

200 OK

7.4 kB

URL GET HTTP/2
www.better-pharm.ru/wp-content/uploads/2020/01/fon.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 504 x 342, 8-bit/color RGBA, non-interlaced
Size
7.4 kB (7435 bytes)
Hash
70dd0d0d4ef26ce566084b6bd34a124c
ed8f716db1320b544382ee8b42122e7fca504453
309052d8dd7c2d0335869f069cf6a100c38e5d07ecb128ececd580c081668695

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/fon.png HTTP/1.1
Host: www.better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: image/png
content-length: 7435
etag: "5f05d9e5-1d0b"
expires: Fri, 19 Apr 2024 00:14:07 GMT
accept-ranges: bytes
cache-control: max-age=43200, s-maxage=10
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/themes/root/fonts/fontawesome-webfont.woff2?v=4.7.0

185.196.8.72

200 OK

77 kB

URL GET HTTP/2
better-pharm.ru/wp-content/themes/root/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 77160, version 4.459
Size
77 kB (77160 bytes)
Hash
af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/themes/root/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/wp-content/themes/root/assets/css/style.min.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: font/woff2
content-length: 77160
last-modified: Tue, 30 Aug 2022 13:13:15 GMT
etag: "630e0ceb-12d68"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200, s-maxage=10
accept-ranges: bytes
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/plugins/menu-image/includes/css/menu-image.css

185.196.8.72

200 OK

2.8 kB

URL GET HTTP/2
better-pharm.ru/wp-content/plugins/menu-image/includes/css/menu-image.css
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
gzip compressed data, from Unix
Size
2.8 kB (2834 bytes)
Hash
9e5db9b88c0c3581642f5e6432fe2195
fdaf25401eed2690b7dd5772db9a26b35f489136
e220247c7ff52c5f6292ba8a547836ad6743bbcef39d42dc1cb36480116916b7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/plugins/menu-image/includes/css/menu-image.css HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: text/css
last-modified: Sat, 20 Jan 2024 12:43:14 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"65abbfe2-d0f"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/cropped-1xbet-192x192.png

185.196.8.72

200 OK

24 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/cropped-1xbet-192x192.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Size
24 kB (24338 bytes)
Hash
867e7d22f5c13c5739b6e3b7f49daa2e
eef5dca28a8db22c0e312f3b5e7c7cbd35005875
82033fdd8ca9e238f00e9bf14be2eaa5a2b12f70e51a5be319d28d3a90d87943

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/cropped-1xbet-192x192.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:09 GMT
content-type: image/png
content-length: 24338
last-modified: Wed, 08 Jul 2020 14:36:21 GMT
etag: "5f05d9e5-5f12"
expires: Fri, 19 Apr 2024 00:14:09 GMT
cache-control: max-age=43200
accept-ranges: bytes
X-Firefox-Spdy: h2

better-pharm.ru/wp-includes/js/jquery/jquery-migrate.min.js

185.196.8.72

200 OK

14 kB

URL GET HTTP/2
better-pharm.ru/wp-includes/js/jquery/jquery-migrate.min.js
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
JavaScript source, ASCII text, with very long lines (13479)
Size
14 kB (13577 bytes)
Hash
9ffeb32e2d9efbf8f70caabded242267
3ad0c10e501ac2a9bfa18f9cd7e700219b378738
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-includes/js/jquery/jquery-migrate.min.js HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: application/javascript
last-modified: Sun, 19 Nov 2023 13:18:23 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"655a0b1f-3509"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-includes/js/jquery/jquery.min.js

185.196.8.72

200 OK

88 kB

URL GET HTTP/2
better-pharm.ru/wp-includes/js/jquery/jquery.min.js
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
88 kB (87553 bytes)
Hash
826eb77e86b02ab7724fe3d0141ff87c
79cd3587d565afe290076a8d36c31c305a573d18
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-includes/js/jquery/jquery.min.js HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: application/javascript
last-modified: Sun, 19 Nov 2023 13:18:23 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"655a0b1f-15601"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-includes/css/dist/block-library/style.min.css

185.196.8.72

200 OK

110 kB

URL GET HTTP/2
better-pharm.ru/wp-includes/css/dist/block-library/style.min.css
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type

Size
110 kB (110147 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-includes/css/dist/block-library/style.min.css HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: text/css
last-modified: Wed, 31 Jan 2024 13:58:02 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"65ba51ea-1ae43"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/themes/root/assets/css/style.min.css

185.196.8.72

200 OK

167 kB

URL GET HTTP/2
better-pharm.ru/wp-content/themes/root/assets/css/style.min.css
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
ASCII text, with very long lines (61362)
Size
167 kB (166554 bytes)
Hash
05278d47781a9fc446ffa11bc50adff5
8a491feb1d832ae6dc12a38fab4265796f9305db
658b03dc652161dc0e813ac7c4c89cab274004401ba01b9dce6ca5f42b1f2dc3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/themes/root/assets/css/style.min.css HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: text/css
last-modified: Tue, 30 Aug 2022 13:13:15 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"630e0ceb-28a9a"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-content/uploads/2020/01/cropped-1xbet-32x32.png

185.196.8.72

200 OK

2.0 kB

URL GET HTTP/2
better-pharm.ru/wp-content/uploads/2020/01/cropped-1xbet-32x32.png
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
2.0 kB (2004 bytes)
Hash
cde5dcb520c00c9a1745879406f2d7e9
e0e8e49580c8a137ac1860ee5ebfd98afb7c9add
28b1f428dedec31af34d634c2a5b3bd3ad1bdb8338439109d6bfe9f6638d5e40

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-content/uploads/2020/01/cropped-1xbet-32x32.png HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:09 GMT
content-type: image/png
content-length: 2004
last-modified: Wed, 08 Jul 2020 14:36:21 GMT
etag: "5f05d9e5-7d4"
expires: Fri, 19 Apr 2024 00:14:09 GMT
cache-control: max-age=43200
accept-ranges: bytes
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap

142.250.74.106

200 OK

7.0 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://better-pharm.ru/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
ASCII text, with very long lines (7186), with no line terminators
Size
7.0 kB (6997 bytes)
Hash
9f87474f6553441484d0512f48d73185
ec7399f61c50182da54d5c44d61c93dde9837ac0
7c2aa4dd5079dc3a6ce51f7432601ac64f62cb1fed212fbd041bea3fa84c4bfe

HTTP Headers

GET /css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 18 Apr 2024 12:14:08 GMT
date: Thu, 18 Apr 2024 12:14:08 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

better-pharm.ru/

185.196.8.72

200 OK

60 kB

URL User Request GET HTTP/2
better-pharm.ru/
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type

Size
60 kB (60195 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding
x-powered-by: PHP/7.4.33
link: <https://better-pharm.ru/wp-json/>; rel="https://api.w.org/", <https://better-pharm.ru/wp-json/wp/v2/pages/14>; rel="alternate"; type="application/json", <https://better-pharm.ru/>; rel=shortlink
x-page-speed: 1.13.35.2-0
cache-control: max-age=0, no-cache
content-encoding: gzip
X-Firefox-Spdy: h2

better-pharm.ru/wp-includes/css/dashicons.min.css

185.196.8.72

200 OK

59 kB

URL GET HTTP/2
better-pharm.ru/wp-includes/css/dashicons.min.css
IP
185.196.8.72:443
ASN
#42624 Simple Carrier LLC

Requested by
https://better-pharm.ru/
Certificate
IssuerLet's Encrypt
Subjectbetter-pharm.ru
FingerprintA6:44:6F:17:9D:FD:FC:A0:2A:24:0E:7C:B5:F3:7E:7A:A9:0E:39:C9
ValiditySun, 07 Apr 2024 20:36:22 GMT - Sat, 06 Jul 2024 20:36:21 GMT

File type
ASCII text, with very long lines (58981)
Size
59 kB (59016 bytes)
Hash
d68d6bf519169d86e155bad0bed833f8
27ba9c67d0e775fc4e6dd62011daf4c3902698fc
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /wp-includes/css/dashicons.min.css HTTP/1.1
Host: better-pharm.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://better-pharm.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.20.1
date: Thu, 18 Apr 2024 12:14:08 GMT
content-type: text/css
last-modified: Thu, 15 Apr 2021 03:55:45 GMT
vary: Accept-Encoding, Accept-Encoding
etag: W/"6077b941-e688"
expires: Fri, 19 Apr 2024 00:14:08 GMT
cache-control: max-age=43200
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML