Report - ifyxp5d3t.com/

Report Overview

Submitted URL
ifyxp5d3t.com/
IP
212.117.190.104
ASN
#7979 SERVERS-COM
Submitted
2024-05-10 05:01:32
Access
public
Website Title
Bigsport
Final URL
ifyxp5d3t.com/#/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
28

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ifyxp5d3t.com	unknown	2024-02-28	2024-02-28	2024-04-22	6.2 kB	893 kB	212.117.190.104
a2.espncdn.com	9909	2008-07-30	2012-07-08	2024-04-29	476 B	148 kB	95.101.11.122
a4.espncdn.com	9266	2008-07-30	2012-07-08	2024-05-03	476 B	104 kB	95.101.11.115
a.espncdn.com	4037	2008-07-30	2012-06-20	2024-05-08	489 B	112 kB	95.101.11.115
a3.espncdn.com	9043	2008-07-30	2012-10-02	2024-05-08	492 B	269 kB	95.101.11.115
status.geotrust.com	3662	1999-04-04	2017-12-01	2024-05-09	331 B	735 B	192.229.221.95
api.time.com	32891	1993-11-19	2019-11-18	2024-04-25	470 B	274 kB	192.0.66.55
ichef.bbci.co.uk	7121	2000-04-02	2012-07-23	2024-05-09	2.9 kB	432 kB	23.210.163.218
a1.espncdn.com	8041	2008-07-30	2012-07-06	2024-05-08	476 B	140 kB	95.101.11.120
media.npr.org	13844	1993-12-13	2012-08-09	2024-05-07	2.5 kB	4.7 MB	23.33.119.81
i.insider.com	14196	1997-06-06	2020-01-16	2024-04-28	912 B	108 kB	151.101.194.217

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed
2024-05-10	medium	ifyxp5d3t.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	ifyxp5d3t.com/runtime.ff2894bb4a0449e4.js	904 B	2024-04-24	2024-05-16
Pretty URL ifyxp5d3t.com/runtime.ff2894bb4a0449e4.js IP 212.117.190.104 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 19:27:47 Last Seen2024-05-16 12:56:09 Times Seen45 Hash ae8b59d89ce8195f1faafa4cdff7b89f 05ea1f888cba07494bccacafb458a7a9ceab0998 4f38d5b4f52e6a15805de197a22438dd2f0d1bd199879e1bb5f490a0681fbf83 Loading...

	ifyxp5d3t.com/polyfills.feafc1b7e962c9c0.js	34 kB	2024-04-24	2024-05-16
Pretty URL ifyxp5d3t.com/polyfills.feafc1b7e962c9c0.js IP 212.117.190.104 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 19:27:47 Last Seen2024-05-16 12:56:09 Times Seen48 Hash 4f3944b4fe157e4336e0943bf8bf5b90 944dd0745ca417f82324bc9850cbd296217850ec ba22b300d0ae17e1343d8e030ef3f075fc86f6da26c50dad69872fcc680ea3c5 Loading...

	unknown	16 B	2023-04-10	2024-05-20
Pretty Introduced by eventHandler Embedded in HTML false Observations First Seen2023-04-10 15:57:29 Last Seen2024-05-20 14:20:54 Times Seen35746 Hash 7c3c3ddeb80438dcbb3d081d2d00e152 5a4016732ee72ec77b4f6ab17047bcea6d2ea34d 321b4f657afbf8ba49518e6ab4cbad07ea967d0b4c68f71c7deed05ed09c1187 Loading...

	ifyxp5d3t.com/main.7398b4adaffc8269.js	323 kB	2024-04-24	2024-05-16
Pretty URL ifyxp5d3t.com/main.7398b4adaffc8269.js IP 212.117.190.104 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 19:27:47 Last Seen2024-05-16 12:56:09 Times Seen47 Hash 3505caa24a530600ccf7591abffd64db 8239d97f6e6f9f05254e80e577255e1e9b9472e2 5bb67ad6b6c132ffc06be9b0b83204e4ce45847b1a8bc3c4af15d48f1b8d8448 Loading...

HTTP Transactions (34)

URL IP Response Size

ifyxp5d3t.com/assets/data/hockey.json?pageSize=8

212.117.190.104

200 OK

60 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/hockey.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
gzip compressed data, max speed, from Unix
Size
60 kB (59466 bytes)
Hash
fba015571092e4a36ef5e9575f53b042
2d1345cddc6f94b9ef65866bae67b37ea8785dec
0734165d3f42191d3b25b28e88b44c8add5082efaac4e8fff47879cfcfeb49af

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/hockey.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-14ee8"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ichef.bbci.co.uk/news/1024/branded_news/8FD3/production/_132991863_gettyimages-1429595170.jpg

23.210.163.218

200 OK

74 kB

URL GET HTTP/2
ichef.bbci.co.uk/news/1024/branded_news/8FD3/production/_132991863_gettyimages-1429595170.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1024x576, components 3
Size
74 kB (74131 bytes)
Hash
2b293465c1b98ad6645af8e1c74c52c1
b6296f638d6173e8a4dbe628017ad506aa1ab4c9
2a368287dde836ea11fcafe889c2a8a5ab05d859443f98bdc6a1db3060720a8f

HTTP Headers

GET /news/1024/branded_news/8FD3/production/_132991863_gettyimages-1429595170.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: AmazonS3
last-modified: Wed, 27 Mar 2024 01:30:58 GMT
etag: "173ae1518087694f6af15d0337453514"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
content-type: image/jpeg
content-length: 74131
expires: Thu, 27 Mar 2025 01:37:12 GMT
cache-control: max-age=31536000, max-age=31536000
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

ichef.bbci.co.uk/news/1024/cpsprodpb/3231/production/_133094821_p0hp9j5q.jpg

23.210.163.218

200 OK

71 kB

URL GET HTTP/2
ichef.bbci.co.uk/news/1024/cpsprodpb/3231/production/_133094821_p0hp9j5q.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1024x576, components 3
Size
71 kB (70879 bytes)
Hash
24878d9f9d7df959734a76345728b1cf
8d35ea29aa2ae0f0064826cf42d67d9959a776c2
eb59d5a9888bc9ef7e5c63a1df0daa03f2db9ef789d200c03724ef5b36ac56ee

HTTP Headers

GET /news/1024/cpsprodpb/3231/production/_133094821_p0hp9j5q.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: AmazonS3
last-modified: Sat, 06 Apr 2024 23:29:17 GMT
etag: "6b876b31fbcbaf537d9afed7b563d8fa"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
content-type: image/jpeg
content-length: 70879
expires: Sun, 06 Apr 2025 23:31:05 GMT
cache-control: max-age=31536000, max-age=31536000
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

ichef.bbci.co.uk/news/1024/branded_sport/05EA/production/_133041510_cdf_141023_cf_wales_v_argentina_069.jpg

23.210.163.218

200 OK

73 kB

URL GET HTTP/2
ichef.bbci.co.uk/news/1024/branded_sport/05EA/production/_133041510_cdf_141023_cf_wales_v_argentina_069.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x576, components 3
Size
73 kB (72652 bytes)
Hash
4b7bd92eef48e3a47c6d223bc152a3d5
9258135c20b7ad7b1bdbedbd3f01db2cff6eabb0
1d53aa11f089dae9fab9587763f562c6534824a556ccee08b1702c5a806572a8

HTTP Headers

GET /news/1024/branded_sport/05EA/production/_133041510_cdf_141023_cf_wales_v_argentina_069.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: AmazonS3
last-modified: Fri, 29 Mar 2024 17:50:52 GMT
etag: "f4ee3aadec664f36092c287cf78e3436"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
content-type: image/jpeg
content-length: 72652
expires: Sat, 29 Mar 2025 17:57:08 GMT
cache-control: max-age=31536000, max-age=31536000
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/data/baseball.json?pageSize=8

212.117.190.104

200 OK

158 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/baseball.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
gzip compressed data, max speed, from Unix
Size
158 kB (157460 bytes)
Hash
1f3ef96cd5300dfdd7394a67a26a5c36
2aae58a3c083ce6c960bfaea1e82fbe35547d185
892323ab36566e61ed540716c0d8848f35590bf92af3f40d40e0dde5eb5dbc88

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/baseball.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-141dd"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ifyxp5d3t.com/styles.110b35752c9ff18b.css

212.117.190.104

200 OK

60 kB

URL GET HTTP/2
ifyxp5d3t.com/styles.110b35752c9ff18b.css
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
gzip compressed data, max speed, from Unix
Size
60 kB (59812 bytes)
Hash
bacb786eaa75dbb2f877ae184bb78730
427b36c1bb4b4086c6ce7065549c463c98fc7511
9d77c841b329d4ecf4a42e3595139882a7299eb82e8d5da0387c06e2663a98b6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /styles.110b35752c9ff18b.css HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: text/css
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-4253"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

a1.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0324%2Fr1309484_1296x729_16%2D9.jpg

95.101.11.120

200 OK

140 kB

URL GET HTTP/2
a1.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0324%2Fr1309484_1296x729_16%2D9.jpg
IP
95.101.11.120:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerEntrust, Inc.
Subjecta.espncdn.com
FingerprintE2:CF:6F:84:0F:FB:AC:6B:4D:B9:7C:1A:3D:CD:11:C2:27:F0:52:8E
ValidityThu, 21 Sep 2023 17:08:27 GMT - Mon, 30 Sep 2024 17:08:26 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1296x729, components 3
Size
140 kB (140135 bytes)
Hash
d04ebe8e3131cac0ebca1b0cb0c22af8
7015f5334579efee7f4fde49d52deeeedd6392ab
a8d7ed6a9d51ddefdc70517d3d4691ee257cb26519c12f024fbf5998bb4d0cd9

HTTP Headers

GET /combiner/i?img=%2Fphoto%2F2024%2F0324%2Fr1309484_1296x729_16%2D9.jpg HTTP/1.1
Host: a1.espncdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Sun, 24 Mar 2024 20:59:26 GMT
content-type: image/jpeg
content-length: 140135
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=72691
expires: Sat, 11 May 2024 01:12:36 GMT
date: Fri, 10 May 2024 05:01:05 GMT
X-Firefox-Spdy: h2

media.npr.org/assets/img/2024/04/05/dei-ncaa_wide-0eb82475de232aea75905a551614375dc1b62a83-s1400-c100.jpg

23.33.119.81

200 OK

465 kB

URL GET HTTP/2
media.npr.org/assets/img/2024/04/05/dei-ncaa_wide-0eb82475de232aea75905a551614375dc1b62a83-s1400-c100.jpg
IP
23.33.119.81:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectwww.npr.org
Fingerprint48:56:5D:E1:B5:BE:B2:10:07:1E:72:13:51:81:B4:37:CA:00:7C:EF
ValidityFri, 05 Apr 2024 19:04:59 GMT - Thu, 04 Jul 2024 19:04:58 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=176, yresolution=184, resolutionunit=2], baseline, precision 8, 1400x787, components 3
Size
465 kB (465123 bytes)
Hash
0d6dc5ae0c890e6bdf63e2c837c6bf15
92c2d97170eee550d5b8c846db98adbd0df62e47
4c2a43c40e28c35fada9575878f366dc61710fe213557cd740052b2d6ad0cb7c

HTTP Headers

GET /assets/img/2024/04/05/dei-ncaa_wide-0eb82475de232aea75905a551614375dc1b62a83-s1400-c100.jpg HTTP/1.1
Host: media.npr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache/2.4.25 (Debian)
last-modified: Fri, 05 Apr 2024 20:02:12 GMT
etag: "718e3-6155eee7d56b6"
accept-ranges: bytes
content-length: 465123
x-served-by: prod-web-49
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=604800; includeSubDomains
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=15552000
expires: Wed, 06 Nov 2024 05:01:05 GMT
date: Fri, 10 May 2024 05:01:05 GMT
akamai-mon-iucid-del: 28919
timing-allow-origin: *
X-Firefox-Spdy: h2

a4.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316237_1296x729_16%2D9.jpg

95.101.11.115

200 OK

103 kB

URL GET HTTP/2
a4.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316237_1296x729_16%2D9.jpg
IP
95.101.11.115:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerEntrust, Inc.
Subjecta.espncdn.com
FingerprintE2:CF:6F:84:0F:FB:AC:6B:4D:B9:7C:1A:3D:CD:11:C2:27:F0:52:8E
ValidityThu, 21 Sep 2023 17:08:27 GMT - Mon, 30 Sep 2024 17:08:26 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1296x729, components 3
Size
103 kB (103391 bytes)
Hash
a088442553bff8865ce7740c767329d3
1f8dc073ada3566cc776a5cdc13293ff8d7848a6
45105e5d2895d92174d7597c15e1e5c28a1ad1cbb2851c15832aacd10c025e65

HTTP Headers

GET /combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316237_1296x729_16%2D9.jpg HTTP/1.1
Host: a4.espncdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Tue, 09 Apr 2024 02:12:15 GMT
access-control-allow-origin: *
content-type: image/jpeg
content-length: 103391
accept-ranges: bytes
cache-control: max-age=41984
expires: Fri, 10 May 2024 16:40:49 GMT
date: Fri, 10 May 2024 05:01:05 GMT
X-Firefox-Spdy: h2

ifyxp5d3t.com/

212.117.190.104

200 OK

54 kB

URL User Request GET HTTP/2
ifyxp5d3t.com/
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
gzip compressed data, max speed, from Unix
Size
54 kB (54378 bytes)
Hash
0eacfae420897c7853856ff7955ab09f
cc1981f9f8b1a3c3d6ceb402d509c5dad8c810ec
8466eb900f449e57fc2088bf9cb6cf256da721b732e5284b56c815d5a01ed31c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: text/html
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-9d2"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

a.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0412%2Fr1317932_1217x685_16%2D9.jpg

95.101.11.115

200 OK

112 kB

URL GET HTTP/2
a.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0412%2Fr1317932_1217x685_16%2D9.jpg
IP
95.101.11.115:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerEntrust, Inc.
Subjecta.espncdn.com
FingerprintE2:CF:6F:84:0F:FB:AC:6B:4D:B9:7C:1A:3D:CD:11:C2:27:F0:52:8E
ValidityThu, 21 Sep 2023 17:08:27 GMT - Mon, 30 Sep 2024 17:08:26 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1217x685, components 3
Size
112 kB (111933 bytes)
Hash
58c8293ae0ba7faac3f5b7b9a72ae111
a9642b8ad85a5410e26b41ad6ec2bf6bc55f22fa
4807078803e18a948be33012be9cfc4dd93670315319b72d91e0871be27cbcff

HTTP Headers

GET /combiner/i?img=%2Fphoto%2F2024%2F0412%2Fr1317932_1217x685_16%2D9.jpg HTTP/1.1
Host: a.espncdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 12 Apr 2024 16:56:42 GMT
content-type: image/jpeg
content-length: 111933
accept-ranges: bytes
cache-control: max-age=48042
expires: Fri, 10 May 2024 18:21:47 GMT
date: Fri, 10 May 2024 05:01:05 GMT
access-control-allow-origin: *
X-Firefox-Spdy: h2

a3.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0404%2Fr1314247_2_1296x729_16%2D9.jpg

95.101.11.115

200 OK

269 kB

URL GET HTTP/2
a3.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0404%2Fr1314247_2_1296x729_16%2D9.jpg
IP
95.101.11.115:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerEntrust, Inc.
Subjecta.espncdn.com
FingerprintE2:CF:6F:84:0F:FB:AC:6B:4D:B9:7C:1A:3D:CD:11:C2:27:F0:52:8E
ValidityThu, 21 Sep 2023 17:08:27 GMT - Mon, 30 Sep 2024 17:08:26 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1296x729, components 3
Size
269 kB (268595 bytes)
Hash
c700c79f082d64cc5cfcaf4847917b67
e7305e7b2481f78aa90d2bafeffe10a1222b8267
6fa341ebe45d15c9f64842d587769f33c973df7c1ce8165f15c541429f6e6a43

HTTP Headers

GET /combiner/i?img=%2Fphoto%2F2024%2F0404%2Fr1314247_2_1296x729_16%2D9.jpg HTTP/1.1
Host: a3.espncdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 04 Apr 2024 18:58:35 GMT
access-control-allow-origin: *
content-type: image/jpeg
content-length: 268595
accept-ranges: bytes
cache-control: max-age=60708
expires: Fri, 10 May 2024 21:52:53 GMT
date: Fri, 10 May 2024 05:01:05 GMT
X-Firefox-Spdy: h2

ifyxp5d3t.com/main.7398b4adaffc8269.js

212.117.190.104

200 OK

169 kB

URL GET HTTP/2
ifyxp5d3t.com/main.7398b4adaffc8269.js
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
gzip compressed data, max speed, from Unix
Size
169 kB (168925 bytes)
Hash
8253617732b5e39e550363fcd855e275
98f00177bfa60845a6775e435b1ad2a074ebd586
0a16774555c92756f6be7de071e35e492488cc56f231d6e5ae24da07adb79906

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /main.7398b4adaffc8269.js HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-4ec76"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

media.npr.org/assets/img/2024/04/06/ap24097106820665_wide-abe2eefe4f848bf63403cb426ea695d6e42b71ef-s1400-c100.jpg

23.33.119.81

200 OK

1.1 MB

URL GET HTTP/2
media.npr.org/assets/img/2024/04/06/ap24097106820665_wide-abe2eefe4f848bf63403cb426ea695d6e42b71ef-s1400-c100.jpg
IP
23.33.119.81:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectwww.npr.org
Fingerprint48:56:5D:E1:B5:BE:B2:10:07:1E:72:13:51:81:B4:37:CA:00:7C:EF
ValidityFri, 05 Apr 2024 19:04:59 GMT - Thu, 04 Jul 2024 19:04:58 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=17, height=2558, bps=222, PhotometricInterpretation=RGB, description=Iowa guard Caitlin Clark (22) reacts with head coach Lisa Bluder during the second half of a Final Four college basketball game, manufacturer=SONY, model=ILCE-9M3, orientation=upper-left, width=3836], baseline, precision 8, 1400x787, components 3
Size
1.1 MB (1108770 bytes)
Hash
e39016dd3c96ee81a9c658b99a4f77a0
0f2769f104e0edc252673734683265f8af983e42
1a2582cf3d0c21fac94a3596fc3e2ba88eed156bf3c055ad2af835da17d90585

HTTP Headers

GET /assets/img/2024/04/06/ap24097106820665_wide-abe2eefe4f848bf63403cb426ea695d6e42b71ef-s1400-c100.jpg HTTP/1.1
Host: media.npr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache/2.4.25 (Debian)
x-powered-by: PHP/7.4.14
x-served-by: prod-web-48
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=604800; includeSubDomains
x-frame-options: SAMEORIGIN
content-type: image/jpeg
content-length: 1108770
cache-control: max-age=15552000
expires: Wed, 06 Nov 2024 05:01:05 GMT
date: Fri, 10 May 2024 05:01:05 GMT
akamai-mon-iucid-del: 28919
timing-allow-origin: *
X-Firefox-Spdy: h2

status.geotrust.com/

192.229.221.95

471 B

URL
status.geotrust.com/
IP
192.229.221.95:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
f211c7f5b089c9f157b8a40b69f8198f
0d5e7cf79c0af8f4f6dbaec1a152b84d60d09045
0b5cec79c2a2879a24980ad047c19bf9de148f62382a90f309cceef2301763e5

HTTP Headers

POST / HTTP/1.1
Host: status.geotrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4908
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Fri, 10 May 2024 05:01:05 GMT
Last-Modified: Fri, 10 May 2024 03:39:17 GMT
Server: ECAcc (ska/F775)
X-Cache: HIT
Content-Length: 471

media.npr.org/assets/img/2024/04/09/ap24098734961152_wide-e72c02c9b51b4a845c43a86b1e86f046850bbb17-s1400-c100.jpg

23.33.119.81

200 OK

1.2 MB

URL GET HTTP/2
media.npr.org/assets/img/2024/04/09/ap24098734961152_wide-e72c02c9b51b4a845c43a86b1e86f046850bbb17-s1400-c100.jpg
IP
23.33.119.81:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectwww.npr.org
Fingerprint48:56:5D:E1:B5:BE:B2:10:07:1E:72:13:51:81:B4:37:CA:00:7C:EF
ValidityFri, 05 Apr 2024 19:04:59 GMT - Thu, 04 Jul 2024 19:04:58 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=17, height=2815, bps=222, PhotometricInterpretation=RGB, description=South Carolina guard MiLaysia Fulwiley (12) drives to the basket over Iowa forward Hannah Stuelke (45) during the first half of, manufacturer=SONY, model=ILCE-9M3, orientation=upper-left, width=4222], baseline, precision 8, 1400x787, components 3
Size
1.2 MB (1220787 bytes)
Hash
3ce82ce8ab2762fecbb70e4be838eb82
93c679ac541b7e161a6a523b90f8308c482f3002
b87dc35ac9b89ebe8fd9332bc65b3c3db922b0b76ea54e0815b0d3d793af6f17

HTTP Headers

GET /assets/img/2024/04/09/ap24098734961152_wide-e72c02c9b51b4a845c43a86b1e86f046850bbb17-s1400-c100.jpg HTTP/1.1
Host: media.npr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache/2.4.25 (Debian)
last-modified: Wed, 10 Apr 2024 10:06:59 GMT
etag: "12a0b3-615bb3307c594"
accept-ranges: bytes
content-length: 1220787
x-served-by: prod-web-8
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=604800; includeSubDomains
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=15552000
expires: Wed, 06 Nov 2024 05:01:05 GMT
date: Fri, 10 May 2024 05:01:05 GMT
akamai-mon-iucid-del: 28919
timing-allow-origin: *
X-Firefox-Spdy: h2

a2.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316537_1296x729_16%2D9.jpg

95.101.11.122

200 OK

147 kB

URL GET HTTP/2
a2.espncdn.com/combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316537_1296x729_16%2D9.jpg
IP
95.101.11.122:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerEntrust, Inc.
Subjecta.espncdn.com
FingerprintE2:CF:6F:84:0F:FB:AC:6B:4D:B9:7C:1A:3D:CD:11:C2:27:F0:52:8E
ValidityThu, 21 Sep 2023 17:08:27 GMT - Mon, 30 Sep 2024 17:08:26 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1296x729, components 3
Size
147 kB (147407 bytes)
Hash
3fd62a4e9934c28c5f42d3dbf4e2a917
d28697cada02367afebf304ab9c08019b55f43e5
42f0889fbb6e8c005a2de5a75e2ffbedbf4f7557ca01050d80671f26089d33fc

HTTP Headers

GET /combiner/i?img=%2Fphoto%2F2024%2F0409%2Fr1316537_1296x729_16%2D9.jpg HTTP/1.1
Host: a2.espncdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Tue, 09 Apr 2024 19:50:37 GMT
content-type: image/jpeg
content-length: 147407
accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=43143
expires: Fri, 10 May 2024 17:00:08 GMT
date: Fri, 10 May 2024 05:01:05 GMT
X-Firefox-Spdy: h2

media.npr.org/assets/img/2024/03/21/solareclipseeducation_30_wide-80e3766f4fe8d25b069281655e064228d3d48c05-s1400-c100.jpg

23.33.119.81

200 OK

1.1 MB

URL GET HTTP/2
media.npr.org/assets/img/2024/03/21/solareclipseeducation_30_wide-80e3766f4fe8d25b069281655e064228d3d48c05-s1400-c100.jpg
IP
23.33.119.81:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectwww.npr.org
Fingerprint48:56:5D:E1:B5:BE:B2:10:07:1E:72:13:51:81:B4:37:CA:00:7C:EF
ValidityFri, 05 Apr 2024 19:04:59 GMT - Thu, 04 Jul 2024 19:04:58 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=10, manufacturer=Canon, model=Canon EOS 5D Mark IV, xresolution=162, yresolution=170, resolutionunit=2, software=Adobe Photoshop Lightroom 6.12 (Macintosh), datetime=2024:03:13 00:41:09], baseline, precision 8, 1400x787, components 3
Size
1.1 MB (1077339 bytes)
Hash
5198982690d82fc0122d8837a532e072
c6d448445508e7f4b33e35e7b9fa9e3db3b376c0
dce8b39732ee862e8221a7b0f4cc2f19ede29f35776a73b25b6ff354ade8b5fb

HTTP Headers

GET /assets/img/2024/03/21/solareclipseeducation_30_wide-80e3766f4fe8d25b069281655e064228d3d48c05-s1400-c100.jpg HTTP/1.1
Host: media.npr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache/2.4.25 (Debian)
last-modified: Mon, 25 Mar 2024 09:11:01 GMT
etag: "10705b-614788d65b44a"
accept-ranges: bytes
content-length: 1077339
x-served-by: prod-web-20
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=604800; includeSubDomains
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=15552000
expires: Wed, 06 Nov 2024 05:01:05 GMT
date: Fri, 10 May 2024 05:01:05 GMT
akamai-mon-iucid-del: 28919
timing-allow-origin: *
X-Firefox-Spdy: h2

media.npr.org/assets/img/2024/04/02/ap24089554430173_wide-e857d7ea9b886a04d6cb49024c806bfacaa0e88d-s1400-c100.jpg

23.33.119.81

200 OK

852 kB

URL GET HTTP/2
media.npr.org/assets/img/2024/04/02/ap24089554430173_wide-e857d7ea9b886a04d6cb49024c806bfacaa0e88d-s1400-c100.jpg
IP
23.33.119.81:443
ASN
#20940 Akamai International B.V.

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectwww.npr.org
Fingerprint48:56:5D:E1:B5:BE:B2:10:07:1E:72:13:51:81:B4:37:CA:00:7C:EF
ValidityFri, 05 Apr 2024 19:04:59 GMT - Thu, 04 Jul 2024 19:04:58 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=11, manufacturer=SONY, model=ILCE-9M3, xresolution=164, yresolution=172, resolutionunit=2, software=Adobe Photoshop Lightroom Classic 13.2 (Macintosh), datetime=2024:03:29 11:20:58], baseline, precision 8, 1400x787, components 3
Size
852 kB (851515 bytes)
Hash
a3775625e1aef89e871501caa940f0ab
5876cca178821edc25f5758d75b3a8ac96f78b60
33c024df33922391170e44972803744b48f88f4319e115ddadaed2f7647d8023

HTTP Headers

GET /assets/img/2024/04/02/ap24089554430173_wide-e857d7ea9b886a04d6cb49024c806bfacaa0e88d-s1400-c100.jpg HTTP/1.1
Host: media.npr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache/2.4.25 (Debian)
last-modified: Wed, 03 Apr 2024 09:03:19 GMT
etag: "cfe3b-6152d7e6d661f"
accept-ranges: bytes
content-length: 851515
x-served-by: prod-web-17
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=604800; includeSubDomains
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: max-age=15552000
expires: Wed, 06 Nov 2024 05:01:05 GMT
date: Fri, 10 May 2024 05:01:05 GMT
akamai-mon-iucid-del: 28919
timing-allow-origin: *
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/default.png

212.117.190.104

200 OK

9.7 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/default.png
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
PNG image data, 640 x 400, 8-bit/color RGBA, non-interlaced
Size
9.7 kB (9698 bytes)
Hash
3d9ef4d50d3c25aaa0008deeb98e1dc4
12c438d2037cbdaa4b2081656b3e6251cb37c5e1
41ba4647f301e79bfcee861f55b0097272a6f3f59811445100d9ea89b574789f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/default.png HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:06 GMT
content-type: image/png
content-length: 9698
last-modified: Wed, 08 May 2024 13:30:33 GMT
etag: "663b7e79-25e2"
expires: Sat, 11 May 2024 05:01:06 GMT
cache-control: max-age=86400
accept-ranges: bytes
X-Firefox-Spdy: h2

api.time.com/wp-content/uploads/2024/04/GettyImages-2068304015.jpg?quality=85

192.0.66.55

200 OK

273 kB

URL GET HTTP/2
api.time.com/wp-content/uploads/2024/04/GettyImages-2068304015.jpg?quality=85
IP
192.0.66.55:443
ASN
#2635 AUTOMATTIC

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerDigiCert Inc
Subjecttime.com
Fingerprint54:AE:7D:BC:11:04:BA:CA:29:C9:AA:5B:A4:44:4D:4C:49:0B:AE:60
ValidityTue, 02 Jan 2024 00:00:00 GMT - Sat, 01 Feb 2025 23:59:59 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 4345x2779, Scaling: [none]x[none], YUV color, decoders should clamp
Size
273 kB (273306 bytes)
Hash
5e78eea14a83dc4bb6676105e38bf901
dcd89bbbfa95446818b9ed9c016c057e72785c81
77fc97108095bf4d8365f55a4bd3858d873297b5edb0aa79ee3d4ac1c3345e2a

HTTP Headers

GET /wp-content/uploads/2024/04/GettyImages-2068304015.jpg?quality=85 HTTP/1.1
Host: api.time.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:06 GMT
content-type: image/webp
content-length: 273306
last-modified: Thu, 11 Apr 2024 20:16:23 GMT
etag: "1f19b8b9c04b7c61"
vary: Accept
cache-control: max-age=31536000
x-rq: arn1 109 83 443
x-cache: HIT
accept-ranges: bytes, bytes
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/favicon180x180.png

212.117.190.104

200 OK

19 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/favicon180x180.png
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced
Size
19 kB (19428 bytes)
Hash
f638edff2ac1b30a7a80dd52e7364f99
3c4c3166a9f3016b3ff15ef5b7fe60b3b9fccf4c
f2509b52e86a02f6baa4a83f291938098fd26e1cd57097409ba4dd4e69acec20

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/favicon180x180.png HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:06 GMT
content-type: image/png
content-length: 19428
last-modified: Wed, 08 May 2024 13:30:33 GMT
etag: "663b7e79-4be4"
expires: Sat, 11 May 2024 05:01:06 GMT
cache-control: max-age=86400
accept-ranges: bytes
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/favicon16x16.png

212.117.190.104

200 OK

606 B

URL GET HTTP/2
ifyxp5d3t.com/assets/favicon16x16.png
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Size
606 B (606 bytes)
Hash
4fe3f3d9df9b3f5918825cf5eed694ee
f55e9903698071be829b1b4a21b5d7ebd75bef1c
eeb713d6098107042bf6b493add0aa376e18880b770893a9918dd1d7d48f6302

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/favicon16x16.png HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:06 GMT
content-type: image/png
content-length: 606
last-modified: Wed, 08 May 2024 13:30:33 GMT
etag: "663b7e79-25e"
expires: Sat, 11 May 2024 05:01:06 GMT
cache-control: max-age=86400
accept-ranges: bytes
X-Firefox-Spdy: h2

ichef.bbci.co.uk/live-experience/cps/624/cpsprodpb/C65A/production/_121787705_gettyimages-1313513292.jpg

23.210.163.218

200 OK

28 kB

URL GET HTTP/2
ichef.bbci.co.uk/live-experience/cps/624/cpsprodpb/C65A/production/_121787705_gettyimages-1313513292.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 624x351, components 3
Size
28 kB (27890 bytes)
Hash
b0ce89a96511ecd832694a4fd7e9302f
940a6e73e428866e3ba2fdc178a7dbb6020b0241
83ff29776b2020f46f4f724c4990c057810b7cfe92a9203b667e6a886efc4b7d

HTTP Headers

GET /live-experience/cps/624/cpsprodpb/C65A/production/_121787705_gettyimages-1313513292.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: AmazonS3
last-modified: Wed, 24 Nov 2021 22:00:50 GMT
etag: "c80d15b81d0a3c1baa1d18508e43ffdc"
accept-ranges: bytes
content-type: image/jpeg
content-length: 27890
expires: Mon, 18 Mar 2024 22:38:14 GMT
cache-control: max-age=31536000, max-age=60
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

i.insider.com/6616e80c16bde8d4ead7815e?width=1200&format=jpeg

151.101.194.217

200 OK

53 kB

URL GET HTTP/2
i.insider.com/6616e80c16bde8d4ead7815e?width=1200&format=jpeg
IP
151.101.194.217:443
ASN
#54113 FASTLY

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.insider.com
Fingerprint54:07:66:BE:D7:93:F4:7A:65:87:F5:C2:EA:FA:7B:CE:EF:02:E1:AF
ValidityMon, 04 Sep 2023 17:25:08 GMT - Sat, 05 Oct 2024 17:25:07 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x600, Scaling: [none]x[none], YUV color, decoders should clamp
Size
53 kB (53318 bytes)
Hash
07c9eb7039b873dfb7fd750b5d1a04ad
5d353f32b88e82dc075f4898ed683058bc204a8c
909ceebf51b1aea504c70cf10f0b5001f5aa6384bb6b7433c7537803bbd7e7d8

HTTP Headers

GET /6616e80c16bde8d4ead7815e?width=1200&format=jpeg HTTP/1.1
Host: i.insider.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=2592000, public
content-type: image/webp
etag: "28O4UgR0zPTzGTkGgT43LwSf4GtdIcJp3QCuS97CiB0"
fastly-io-info: ifsz=320449 idim=2500x1250 ifmt=jpeg ofsz=53318 odim=1200x600 ofmt=webp
fastly-io-served-by: vpop-kiad7010251
fastly-stats: io=1
server: AmazonS3
x-amz-id-2: GdXeyG/cxtwZLoJzi8L+ozDfjhjBd3zzv5BFb+AmeUIrZbNP9K86rulUubaON9zURLXPqJttRc0=
x-amz-request-id: 1W8XN33ZFVHES4XV
x-amz-server-side-encryption: AES256
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 10 May 2024 05:01:05 GMT
age: 2458517
x-served-by: cache-iad-kcgs7200083-IAD, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 62, 5231
x-timer: S1715317265.337573,VS0,VE0
vary: Accept
access-control-allow-origin: *
content-length: 53318
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/data/basketball.json?pageSize=8

212.117.190.104

200 OK

82 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/basketball.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type

Size
82 kB (82054 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/basketball.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-14086"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ifyxp5d3t.com/runtime.ff2894bb4a0449e4.js

212.117.190.104

200 OK

904 B

URL GET HTTP/2
ifyxp5d3t.com/runtime.ff2894bb4a0449e4.js
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
ASCII text, with very long lines (906), with no line terminators
Size
904 B (904 bytes)
Hash
a61be070e6165313d2361599d72d3680
1eda768739f521be6299b359072d17d835782bae
48ae38ffe702d2dda53be4d036d21c48c6b570d06e4fc8a6daf7ae02d552fe6c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /runtime.ff2894bb4a0449e4.js HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-388"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/data/football.json?pageSize=8

212.117.190.104

200 OK

78 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/football.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type

Size
78 kB (77491 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/football.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-12eb3"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ichef.bbci.co.uk/news/1024/branded_news/13992/production/_133147208_busaccidentcrop.jpg2.jpg

23.210.163.218

200 OK

55 kB

URL GET HTTP/2
ichef.bbci.co.uk/news/1024/branded_news/13992/production/_133147208_busaccidentcrop.jpg2.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x576, components 3
Size
55 kB (55128 bytes)
Hash
ab6be5487a27b15bdc18c5f07fd6ba00
d828862e90d030227572642dbb25e572f33ff4b5
035c238afbef5fac00765576fa0ae2f89123ebce4147bcdfc651385460ed6cf7

HTTP Headers

GET /news/1024/branded_news/13992/production/_133147208_busaccidentcrop.jpg2.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache
last-modified: Sun, 14 Apr 2024 13:56:31 GMT
etag: "d25b2086cdab5108a430bbdddc9edece"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
content-length: 55128
expires: Mon, 14 Apr 2025 14:06:05 GMT
cache-control: max-age=31536000, max-age=31536000
content-type: image/jpeg
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

ichef.bbci.co.uk/images/ic/1200x675/p0cb6b8k.jpg

23.210.163.218

200 OK

128 kB

URL GET HTTP/2
ichef.bbci.co.uk/images/ic/1200x675/p0cb6b8k.jpg
IP
23.210.163.218:443
ASN
#16625 AKAMAI-AS

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Size
128 kB (127505 bytes)
Hash
0f00a9976700805dfbb52a1e33d92c28
f1ebbbfdcef005e3f4e18d0332f6a84a4f499028
8cbc070cd0ba0b647a1b80e74ec090493e593126f3e23ad5db0dfdb12e90f2b1

HTTP Headers

GET /images/ic/1200x675/p0cb6b8k.jpg HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
expires: Thu, 28 Mar 2024 18:00:59 GMT
last-modified: Tue, 31 May 2022 11:01:14 GMT
etag: "fd5a894c4f392d1aafda4293c2b40301"
cache-control: max-age=86400
server: AmazonS3
accept-ranges: bytes
content-type: image/jpeg
content-length: 127505
date: Fri, 10 May 2024 05:01:05 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2

i.insider.com/65fb01eb2417f97b87cdad94?width=1200&format=jpeg

151.101.194.217

200 OK

53 kB

URL GET HTTP/2
i.insider.com/65fb01eb2417f97b87cdad94?width=1200&format=jpeg
IP
151.101.194.217:443
ASN
#54113 FASTLY

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerGlobalSign nv-sa
Subject*.insider.com
Fingerprint54:07:66:BE:D7:93:F4:7A:65:87:F5:C2:EA:FA:7B:CE:EF:02:E1:AF
ValidityMon, 04 Sep 2023 17:25:08 GMT - Sat, 05 Oct 2024 17:25:07 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x600, Scaling: [none]x[none], YUV color, decoders should clamp
Size
53 kB (52974 bytes)
Hash
1e9961c38fe5846fea7c59bcdb8f294e
94cc19bf4638d31a8871dd169ff43098f170accf
899c725f93c10d6640e4092a849650a5f873ba49098a4ffbd645399eb9a6f529

HTTP Headers

GET /65fb01eb2417f97b87cdad94?width=1200&format=jpeg HTTP/1.1
Host: i.insider.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: max-age=2592000, public
content-type: image/webp
etag: "DP+tdJO4q8OnlHT1pTeWzFlO3YRM7nWV+uAyQXw+1SI"
fastly-io-info: ifsz=574411 idim=3534x1767 ifmt=jpeg ofsz=52974 odim=1200x600 ofmt=webp
fastly-io-served-by: vpop-kiad7010215
fastly-stats: io=1
server: AmazonS3
x-amz-id-2: +9TodioRUoF1vxRjjNCF+L0b8Wx3hRxyy0DQw+dLbZXv859TajHMXP2OSQEdIFCmPJ0iR0MFvB0=
x-amz-request-id: C5B0SJXHRBWG0B7F
x-amz-server-side-encryption: AES256
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 10 May 2024 05:01:05 GMT
age: 861636
x-served-by: cache-iad-kiad7000081-IAD, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 21951, 1122
x-timer: S1715317265.339076,VS0,VE0
vary: Accept
access-control-allow-origin: *
content-length: 52974
X-Firefox-Spdy: h2

ifyxp5d3t.com/polyfills.feafc1b7e962c9c0.js

212.117.190.104

200 OK

34 kB

URL GET HTTP/2
ifyxp5d3t.com/polyfills.feafc1b7e962c9c0.js
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type
JavaScript source, ASCII text, with very long lines (34179), with no line terminators
Size
34 kB (34179 bytes)
Hash
4f3944b4fe157e4336e0943bf8bf5b90
944dd0745ca417f82324bc9850cbd296217850ec
ba22b300d0ae17e1343d8e030ef3f075fc86f6da26c50dad69872fcc680ea3c5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /polyfills.feafc1b7e962c9c0.js HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/javascript
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-8583"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/data/tennis.json?pageSize=8

212.117.190.104

200 OK

84 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/tennis.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type

Size
84 kB (83986 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/tennis.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-14812"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

ifyxp5d3t.com/assets/data/NFL.json?pageSize=8

212.117.190.104

200 OK

80 kB

URL GET HTTP/2
ifyxp5d3t.com/assets/data/NFL.json?pageSize=8
IP
212.117.190.104:443
ASN
#7979 SERVERS-COM

Requested by
https://ifyxp5d3t.com/
Certificate
IssuerLet's Encrypt
Subjectifyxp5d3t.com
Fingerprint93:96:10:C4:5B:B1:A7:BE:69:B5:E3:2A:50:67:82:93:F1:E9:EB:A1
ValidityWed, 28 Feb 2024 05:05:16 GMT - Tue, 28 May 2024 05:05:15 GMT

File type

Size
80 kB (79904 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /assets/data/NFL.json?pageSize=8 HTTP/1.1
Host: ifyxp5d3t.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ifyxp5d3t.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 05:01:04 GMT
content-type: application/json
last-modified: Wed, 08 May 2024 13:30:33 GMT
vary: Accept-Encoding
etag: W/"663b7e79-13820"
expires: Sat, 11 May 2024 05:01:04 GMT
cache-control: max-age=86400
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (34)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers