| login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ |  104.21.56.114 | 403 Forbidden | 8.1 kB |
URL User Request GET HTTP/1.1login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ IP104.21.56.114:80
File typeHTML document, ASCII text, with very long lines (18337), with no line terminators Hash123610eef78854a281d2ef4d018d9ca6 9668a3e770bfffe45c1c085a07720e0c54b4e4c8 4f72d1f6927763f174eeefb36a690d1840aee9f945fb38ea7df95934a62a4d80
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 09:33:50 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: OitpVhSDEOs7cvpfeTtPwiL6fEkOnsga4YLMW5oz0Qp6KlRRJ2Kz+r2pJrlbLX6Vs9nIBf6WX0EvCEKPScgAAxWdm3aHYABdPj7bszCqi4Y=$E2km1zrbItzXmE+OzgSGZg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nQFwQb5IfgVj0%2Fcnmg2rU9CtPy2IAlpsF00JDMh%2BYqPTTxrfIE%2FJG4B%2FlbV2nT2vVjsPwGmNmBM409G1mBh1nGc3ho4hpUTb36X7K3iPFl3Nu0kG4cKkRQjHLgmK4WP9p%2Bo%2BCbX4RckmKfPxzy6aPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 88087359a8eb56ab-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=https://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ | 104.21.56.114 | | 121 kB |
URL login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=https://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ IP104.21.56.114:0
File typeHTML document, ASCII text, with very long lines (20030), with no line terminators Size121 kB (120768 bytes) Hash26d71b0af9c55c3a89aa7e3cde53b23e 82b26077b9ec21b8878b342884a60d75b0faf961 2b0cc7950146e8692f79c3b5a7d5e1790197dfe6aca3c9ebf22c8198b6aaccf8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=https://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Wed, 08 May 2024 09:33:50 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: sxeQd3840fiME3XVWCQp53N2EZ2GPbfogie8F6+tWi94URmwP80e23MEVf7Gsok/RzfZR/RVAWpSUaV41+Fux9j0G4made6ERcGmY1l5L8A=$QpUm/ZjLAZmk7s4sHaicCQ==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9zYfqPwYlKnOM9YVHbicYUxRGEUb245f6jq0LfyXrvHC2s0TK3WinEy3uGMHQ%2BCTHwNDL%2BjiEFJKKyOsStn4V7fXbugadiLWd007A4axuZbF1GErw%2Fhxuor4x37zqFC0cGmEJPkCyN4YmZPBYIiQnA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880873589e3456b9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 |  172.67.184.224 | | 12 kB |
URL login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 IP172.67.184.224:0
File typeASCII text, with very long lines (16256), with no line terminators Hash52e1d7c1ac7971a5e9ca0827dc2612eb 383af89412c153e3082c44153582d9137e6f8af5 01b341395846c0ce7c96c5ccf0c282faa7f56d38c1d5d9cc8f8595b9f01e9c4c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Content-type: application/x-www-form-urlencoded
CF-Challenge: ff9b386114a3cc0
Content-Length: 2672
Origin: http://login.restore-cord-bot.online
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 09:33:51 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: Jl1zSK73Wh6sTTbWFv3yj+BxtzqHzJCOEoJ3Znb09g1FgnT978yWTUQUopAZstON$+Ght88/uYlevnaoUR6PieA==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yK3QzhWwX82Me3kIcfCKzpkZmWTPN%2Ff3JpOO6WWc4TpWD1J3AZWIX1hMHooO7Py%2FfCsn0JkIXLTaiRLPCVqpKMW4MdledJ4YEHXVUm9Rg624nRaTKyGmB0vBVy%2BKa0cKrreQSYZ3IzdokJ8DPY1lug%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8808735c1fc356b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/favicon.ico | 172.67.184.224 | 404 Not Found | 0 B |
URL GET HTTP/1.1login.restore-cord-bot.online/favicon.ico IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ&__cf_chl_rt_tk=p5uTcxWWkMMJX926voo.it29rKEQeYqLs3EfqmSMezg-1715160830-0.0.1.1-2943
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 09:33:51 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2B841U9km8vyKHQXtQh8hb1MK9ncIn%2BRxeJ5%2FKwAYP5HjLLwxvf9049%2FP17oTFvkCQWVkgbwmRLn4J8E5Y%2BoOD77AvRZf8z15bNQgb82gMiboR7T8N2bCScdHP4FkvIQhX9Q4CpCWfQhMfcF28vTyw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8808735aec0a0b02-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/favicon.ico | 172.67.184.224 | 404 Not Found | 0 B |
URL GET HTTP/1.1login.restore-cord-bot.online/favicon.ico IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 09:33:51 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 0
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R7Go1tvukLMrSfZ95kHlV%2FZVuwh0cpGPYwY3bZyj8SFX0K28UifdYU23fR7l6db6%2B8lSRSOV8Nw7mKZF39u1lTs5QkvnedClA0Se8cNBCK%2F%2FBd5B0cdojuvW2JGGs1Ngz82RLNHnzwejHWNkXZyW6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8808735b4eb9b523-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.3.184:0
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/a7if4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 09:33:51 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 8808735d8aff5694-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1323012203:1715157332:83yCWWEVnIG8Y3PKVdJYEPOIb0yIFRR9Xbt6h7Hk1bQ/8808735cea745694/efc409406d3ac8c | 104.17.3.184 | | 106 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1323012203:1715157332:83yCWWEVnIG8Y3PKVdJYEPOIb0yIFRR9Xbt6h7Hk1bQ/8808735cea745694/efc409406d3ac8c IP104.17.3.184:0
File typeASCII text, with very long lines (65536), with no line terminators Size106 kB (106435 bytes) Hash9b35eabb1532430b0b9211501ca5275f bde816aabc2767532212a914200f539e57992e61 5f5cec880a365060b0f6c67be27b48dddcc0ae59a90827bffc12454a2b772c9c
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1323012203:1715157332:83yCWWEVnIG8Y3PKVdJYEPOIb0yIFRR9Xbt6h7Hk1bQ/8808735cea745694/efc409406d3ac8c HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/a7if4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: efc409406d3ac8c
Content-Length: 4179
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 09:33:51 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: plb/qmf/0Vo/kRxlW9cElPBNLm2/n3cxldK8gwJ+sId+hPz4m7+3y2dmpjx0V3LlDdxPiwUGhYdqdIrKo2yOf3A0G+QdYs3zEKqGN/HR7KN7SPHC2ErmJzUpBHe1ETEUskhzIWssuyHKai+dEBkfazdLd8TBtyjQ3AgcQMJkGMxv8iIN2xi/wIAj03v4ytZuyHkspMxu+oCK+WujQOobYu/H83ust5JueyOIndli3zB9hqw+XjDvsP4Fxfc9lTUGzYMVcLnEJfbavIrG6qLgjd+DHn616XguwPP7nxjqn1dwua/TqnAhnym404nJX97I28s0p5dyWTxCx+Lved80jLeXzdGJCjYQoCtMHYR+tqTZVsV+lpIwOl9VMX9kNKW8vffEt23ufXEMBF32u2zb++1jkjyVhm9RyBip63M4GDI=$eS7LcopIT+iL5cCxnUDUOg==
vary: accept-encoding
server: cloudflare
cf-ray: 8808735f5c9a5694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8808735cea745694/1715160831915/ogRvEpBqqSsYKA1 | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8808735cea745694/1715160831915/ogRvEpBqqSsYKA1 IP104.17.3.184:0
File typePNG image data, 85 x 64, 8-bit/color RGB, non-interlaced Hash91815445652f24bd922987c63acbc43c 645ad2013582741585abb9578b722486158ae9c6 aa4d473b0d96e175c29e124dfa9b98babdb5026ed2dc23a2da54c2adecaff7e8
GET /cdn-cgi/challenge-platform/h/b/i/8808735cea745694/1715160831915/ogRvEpBqqSsYKA1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/a7if4/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 09:33:52 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 8808736308405694-OSL
alt-svc: h3=":443"; ma=86400
|
|
| login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 | 172.67.184.224 | | 1.8 kB |
URL login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 IP172.67.184.224:0
File typeASCII text, with very long lines (2328), with no line terminators Hash5175809984e25a3f0836f167d84821a4 dd3392ddb5ee6bdbaf612e0f1a197cb2aa277809 f069624bce0dd660c0d9af47229b92e4ff0b36b560acf39c12a864bd6e896155
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/338809892:1715157169:-4WwTfP-TCWf2HG0KXIUVPeNacp2uLx2omKS6zux9WE/88087359a8eb56ab/ff9b386114a3cc0 HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Content-type: application/x-www-form-urlencoded
CF-Challenge: ff9b386114a3cc0
Content-Length: 3335
Origin: http://login.restore-cord-bot.online
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 09:34:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out: uBv9vO4r58UjvVq0gkkHtwKNhsC8coC9m9v3PJxTEcJbd0vZftbTwtflBEujTpJXMMSdfTdvli68dSc7t387oj+t4RlpM5s6aMR/0BCvyyA=$8B42K6v0pDRuOMRccnEo7g==
cf-chl-out-s: uJad82LMIy5TH/Pc32DA5w==$icsIY2oqsDxP7OsqSO2bsw==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NKaSsQsh%2Bp5ZH38DrwKm8B2eFtDIdOSbgnQxbNjsMF%2BebP2fyV4aL1iHDUnu3S4EBIqTrmOH49S%2BMnYw1CDMHQb7CXL0KCIyAd%2BqES5%2FbsPzTdKZEzOYsicNK4WVIWXc4mh5HNHPUP7E47xSsD0qFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880873920d780b02-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ | 172.67.184.224 | 403 Forbidden | 8.1 kB |
URL User Request GET HTTP/1.1login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ IP172.67.184.224:80
File typeHTML document, ASCII text, with very long lines (18358), with no line terminators Hashc22fa6a5eaaec2ff2caf3535f66baa9b 359686741d53b2626a8f387ebd42c7ddca415b89 565ec82bb627cbb16a3c43b9dca03e2fccedf36fa04bc2f7ad5e1c216560b1a4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 09:34:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 5V1oHTzjfvvS+iT3L0OSBs83GTqest+fZrQ26ZAUIPt0qU/z++je74xnMcW4fb31clqIHplIbNfxjibPnaVFAUDohOHbh8DK/tNQsGv8sCM=$jBtYPoYWyGtXP/1gmprQeg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q0Bydm4w42aPutPA1NnRVYPq7WbpkZc3tfuPnoZb%2BYXnRE4NKW99vuQI4YWyJX4WF940HCYPcGHB1ia3xg1Z%2B76W8dH2QKouVvOD5%2FtJbx0zXEpPotVyAUksEONWDIWQHGF0kBDiEpoVJ6Bq3ti%2FkA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8808739eeebd0b02-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8808739eeebd0b02 | 172.67.184.224 | 200 OK | 112 kB |
URL GET HTTP/1.1login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8808739eeebd0b02 IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size112 kB (112344 bytes) Hash43f6c2ef553be484321bdb79e9e61ab9 708962743fe01d1f9a745ee513c5a62c34a63d14 c99c1c2d6cec1d736f613c44c7b0312a9c69b40b053ed7ca51b90edc97689951
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8808739eeebd0b02 HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ&__cf_chl_rt_tk=ToS6ZxNBc7qCG.NeRirtDjw9KE._umavhV9qp5o0jgo-1715160842-0.0.1.1-2943
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 09:34:02 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=01bPa3vgN3PKcwfvXPrk%2FTU2dWdbN%2FncHivD7lJQVE2qRRl%2BgfUNTEwxMFk7TrRWoC74PYJgv%2F3cx8dOS7SsM5QBZTf6N4Vvb6%2B6HFWc42GrfoCjDIUGZ8YPEQRUBxQ%2F8ZTCON5kFrBBCmGjSSIiGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8808739f2e4a56b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/favicon.ico | 172.67.184.224 | 404 Not Found | 0 B |
URL GET HTTP/1.1login.restore-cord-bot.online/favicon.ico IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ&__cf_chl_rt_tk=ToS6ZxNBc7qCG.NeRirtDjw9KE._umavhV9qp5o0jgo-1715160842-0.0.1.1-2943
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 09:34:02 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 11
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kVfB3kaH1JuEPQDHf58QF%2BrP%2F2hyX5kIktfxwjtoA8yRC%2FThYtG1JHFZzsxbnlRKZzqfHeX1S0wE4xNCW7Ok8QdNOZe9AMwnO0Kz7S6%2FxlXw65whbAkhlkVBg0znqs%2F8L1AG3VOBzp%2Fq2%2FwuZ3u%2FYg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8808739f7edd56b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/favicon.ico | 172.67.184.224 | 404 Not Found | 0 B |
URL GET HTTP/1.1login.restore-cord-bot.online/favicon.ico IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 09:34:02 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Origin: *
ETag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 11
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2BNl6kNB4yXa7CAR52h6gO68lO3Qb8p%2Bv8maiGQ2lA1X%2FgNrgcKeZ5lGgJ7HRm11NTWyMsCyPSJ4SM1X3LqbSINKp%2Faxp%2FdEbbasVFIn2vG%2BNKSDv%2F83rsLFazvzCwXzjC%2FyCoR7DRsZqDG6Oqp02Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880873a00fb256b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b | 172.67.184.224 | 200 OK | 12 kB |
URL POST HTTP/1.1login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
File typeASCII text, with very long lines (16256), with no line terminators Hash0b13548af2a56e48f2a0cafe2878680b fd8fb1006485be69368d816bfdc4dbe295a03be0 244b5e7d8e838c089e8c33686c08bd37b70e7a55d34214b813149381eb1d2e48
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Content-type: application/x-www-form-urlencoded
CF-Challenge: d5404c3eeb5025b
Content-Length: 2657
Origin: http://login.restore-cord-bot.online
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 09:34:02 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: qkIKK9uh2HFwqs1RfLkVYslSoO3XGQsjbhZ8JPEsmwJ7t3AOZRtNKKp0Ivmn1SFh$4k+weB2As02Qb+okWR6RFA==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yh5c6DvqX0hDNTR1GuxBWsIreRKiaKQKj%2BU1kLe5UWUXUBA3IWkwnmfUnDq2izsnePA2H7c2PKYvmw1K%2FFxl2axkL8cqwCHNrr7laGFLGcCJyaU%2FwO790s%2BeZC5ViOojaS4xtH5z5hzv185fuutKSA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880873a0a86556b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0x9hf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal | 104.17.3.184 | 200 OK | 26 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0x9hf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal IP104.17.3.184:443
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (41702) Hash524053c832d3ed0205da3bf825defdb8 f2b2f9813c000f19c4a2707a157deb439400a2d3 223f64cf7430a235769ee28c60513f97b2088ea0d538500f719cdf425c61c3e7
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0x9hf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 09:34:02 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
referrer-policy: same-origin
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
server: cloudflare
cf-ray: 880873a16dee5694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880873a16dee5694/1715160842887/WgbQ9xX0GjeIs-r | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880873a16dee5694/1715160842887/WgbQ9xX0GjeIs-r IP104.17.3.184:0
File typePNG image data, 28 x 99, 8-bit/color RGB, non-interlaced Hash5ab8b7cff201576e7567883ef5a564a4 72a99601eef6e550fc94df616ae56248d30da397 e614a0160f2084cf1494cfa9dfca45b892ea2ae3458f801cc17efc0047d3b2c3
GET /cdn-cgi/challenge-platform/h/b/i/880873a16dee5694/1715160842887/WgbQ9xX0GjeIs-r HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0x9hf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 09:34:03 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 880873a79c1a5694-OSL
alt-svc: h3=":443"; ma=86400
|
|
| login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b | 172.67.184.224 | 200 OK | 1.8 kB |
URL POST HTTP/1.1login.restore-cord-bot.online/cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b IP172.67.184.224:80
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
File typeASCII text, with very long lines (2328), with no line terminators Hashce782a4fbecd9efa161f8105884f80ed 85d5852ae1d02924d53f7950aa7eb4eda2128945 5d1d899d18d23490ed1791a55ee353d29b2e3cb3d230bfc6004f62fac979f0ee
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1638618622:1715157156:im51U0YkUFr2eVJOgtVOxzdzqY74inGNvySPc8Mvtqg/8808739eeebd0b02/d5404c3eeb5025b HTTP/1.1
Host: login.restore-cord-bot.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ
Content-type: application/x-www-form-urlencoded
CF-Challenge: d5404c3eeb5025b
Content-Length: 3347
Origin: http://login.restore-cord-bot.online
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_m=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 09:34:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out: 2FUz+iHhHlwFftbvgp1xLo9JdwOe1zxw9LPr74BTwhrSCZuL3Le+P36JGZ9cpiREnNkBcrH8kf6Bvv+dHELisvKXqoxO2MXTkhL7T8dlP34=$l1Y+k6eeScKepg5Y1Pj5ig==
cf-chl-out-s: SaHulnruvpEtKflNTSiB7g==$vROSd9m03+dkAnYnwH3gAQ==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DEDuthMo3FiNGnyRALjyysNe8%2FXMZVN8PpEODpggsyqBOqnqapuA%2BUO9%2F0mf9uzJWmAvvFBmMDKtKHnavjhzEsUrI2Z4PXBp0r2ZapW5MMtC3KFPw2XAM0ucILKP3yDpH5Z3xx4haw1iR4%2F2%2FBl%2BWg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880873da282456b7-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit | 104.17.3.184 | 200 OK | 43 kB |
URL GET HTTP/3challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit IP104.17.3.184:443
Requested byhttp://login.restore-cord-bot.online/login?redirect_to=/oauth2/authorize?client_id=1235507493564715018&redirect_uri=http://restorecord.com/callback&response_type=code&scope=identify%20guilds%20guilds.join&state===QP9ElZpVVbiBHetJmd1MEZ2p0VMtmSzImaxMlW5lzRkpnVtNWd0cVYulzRil2bqlUdsdVW0lzRal2dplUerRlSFhGVKdEbUp0dZVlS4tGVKVEaUp0RsRlS3lVVKZEbUpEMrRlSHxGVKdXWVp0dJRlS0ZkMRRjT6V1dJRlSykEVKdXSUpke0dVWshXRNlXVpFVeVN0T4lUaPlWVXJGa10WSzFkaNBTTU5EeFpmT4VFVNNTRq9UaNhlW5x2RjRjVtl0cJN0T4FEVOh3YE5kMVpXT1EleOdXVU5keJRVTp9maJtGbFRWdWdVYz5UbJNXSp1UMjR1TwsGRPhXSq5keRRlT0UkeNpXSU1UavpWSrxWRaNHbXRmbKlXZ CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (42565) Hasha5b92920e25651d2058f4982a108347b caeeadd68d38fdb681c52006c68880abc2e8a1a6 49a5abedf03eb8ad9a66eca7c5ccb8e59a440e06958e1e7b71d078f494178dc5
GET /turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://login.restore-cord-bot.online
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 09:34:02 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: max-age=604800, public
vary: Accept-Encoding
server: cloudflare
cf-ray: 880873a00c6d5694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|