| cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.slim.min.js |  104.17.24.14 | 200 OK | 22 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.slim.min.js IP104.17.24.14:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65241) Hash1276065911521c5c22037a31365d179d d1c6704e94efe2d465fc161b6381e127d35acd81 bbb7b9921ca2b61948753a6edb63c78443663dc45d1621d18e102e1dcb34e512
GET /ajax/libs/jquery/3.6.0/jquery.slim.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:13 GMT
content-type: application/javascript; charset=utf-8
content-length: 22329
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-11ab4"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 871600
expires: Wed, 30 Apr 2025 18:42:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EDH75WA9No%2BLnCkKxFgtc9rgMFbOw5qwvTphYNIQCb0KNsIRRY4lzhNO1UHX6PxjG01AlRfsq9ce9aZBzkS3br3fnoXIG6FhFQBGq3o9xyoXTSKZVxrPODNjr%2BDc%2FT%2FZlZXzLNyY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881c11630c46b523-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/lazysizes/5.3.0/lazysizes.min.js | 104.17.24.14 | 200 OK | 3.2 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/lazysizes/5.3.0/lazysizes.min.js IP104.17.24.14:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (7862) Hash96201abb62283557a9d7b97b4cab14ab a72f33d920d0ab863df4cb60edf44ec140304cdb 46112dbceed738f759d03f04b115d5256a7d73660b7795acb382192ad84d9f98
GET /ajax/libs/lazysizes/5.3.0/lazysizes.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:13 GMT
content-type: application/javascript; charset=utf-8
content-length: 3150
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5ff0b799-1ed1"
last-modified: Sat, 02 Jan 2021 18:12:41 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 868328
expires: Wed, 30 Apr 2025 18:42:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0CqAygZXxnLee%2BTpe%2FfaEFuIziTRZEjRTA9%2BLzdf2BmnNv%2FRJ9wJgjAg1AJ2Iz%2F8OeOqcnlD3oHTe%2BGEtMOy5CXFnDe0DO5RpYAaImZMH3yRgUqwGr474pXPgQKlgzuQc021A1wC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881c11630c3bb523-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| 3.bp.blogspot.com/-ZZSacDHLWlM/VhvlKTMjbLI/AAAAAAAAF2M/UDzU4rrvcaI/s1600/btn_close.gif |  142.250.74.161 | 200 OK | 362 B |
URL GET HTTP/23.bp.blogspot.com/-ZZSacDHLWlM/VhvlKTMjbLI/AAAAAAAAF2M/UDzU4rrvcaI/s1600/btn_close.gif IP142.250.74.161:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectmisc-sni.blogspot.com FingerprintC4:7D:61:88:AB:F1:15:A1:36:2A:68:39:51:62:46:00:23:6D:39:00 ValidityTue, 16 Apr 2024 03:45:20 GMT - Tue, 09 Jul 2024 03:45:19 GMT
File typeGIF image data, version 89a, 52 x 15 Hashfd2c05a8c327ace309722b0a5fc4faf3 f446e97c43f8830be9f60644563dd846abe6b8e8 0450e2e1aa3c8b5435690d841f3e573c4f521864e1f8e01a5b6dbcdac922c8b4
GET /-ZZSacDHLWlM/VhvlKTMjbLI/AAAAAAAAF2M/UDzU4rrvcaI/s1600/btn_close.gif HTTP/1.1
Host: 3.bp.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
content-disposition: inline;filename="btn_close.gif"
x-content-type-options: nosniff
server: fife
content-length: 362
x-xss-protection: 0
date: Fri, 10 May 2024 17:51:06 GMT
expires: Sat, 11 May 2024 17:51:06 GMT
cache-control: public, max-age=86400, no-transform
age: 3067
etag: "v1764"
content-type: image/gif
vary: Origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ads.bisniskini.biz.id/get/site/js/d0b1e71bd1922518d7cf826d604fe57a | 172.67.214.128 | 200 OK | 140 B |
URL GET HTTP/2ads.bisniskini.biz.id/get/site/js/d0b1e71bd1922518d7cf826d604fe57a IP172.67.214.128:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectbisniskini.biz.id FingerprintCB:C5:50:71:58:97:D7:6D:B9:8F:63:0E:B9:30:B7:87:1D:05:E2:5A ValiditySun, 14 Apr 2024 15:48:05 GMT - Sat, 13 Jul 2024 15:48:04 GMT
File typeHTML document, ASCII text, with no line terminators Hash613e75c06a28ec97154a5377fee5a84a 0e90f96404fd96309ec40fe6b1403c5565cdfaa7 288a35e42dbea205601d112e4e6e1017487060c55c5dd6249fc654b4660210ce
GET /get/site/js/d0b1e71bd1922518d7cf826d604fe57a HTTP/1.1
Host: ads.bisniskini.biz.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:14 GMT
content-type: application/javascript
content-length: 140
set-cookie: PHPSESSID=67roo9kl67phsi2t8lo74r22f1; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3q5TFr6GRpsUjs7nA24HyUjHvwWVNF4y2HT6Le4aW9mqHWrEAmSSfJseos2lZrtxb4blSQexJCkOHseCPKKAcA8Zqh88QkCpabbgyNzO5WoPQZ3pkUiZ2TFw23kPy%2FXy1sckrErmy8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881c1162fbd37128-OSL
X-Firefox-Spdy: h2
|
|
| ads.bisniskini.biz.id/get/site/js/9049b3a33fc36afe5806bf92a1b0bc1f | 172.67.214.128 | 200 OK | 218 B |
URL GET HTTP/2ads.bisniskini.biz.id/get/site/js/9049b3a33fc36afe5806bf92a1b0bc1f IP172.67.214.128:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectbisniskini.biz.id FingerprintCB:C5:50:71:58:97:D7:6D:B9:8F:63:0E:B9:30:B7:87:1D:05:E2:5A ValiditySun, 14 Apr 2024 15:48:05 GMT - Sat, 13 Jul 2024 15:48:04 GMT
File typeASCII text, with CRLF line terminators Hash53d76623d9d99464e544bae28620f09f 15762f2bde793d241f10807442f825e8b732b501 0aae87e7770c472eaf96f99fc7c6d0c6fb29815cba1734f672af54d5f24e3400
GET /get/site/js/9049b3a33fc36afe5806bf92a1b0bc1f HTTP/1.1
Host: ads.bisniskini.biz.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:14 GMT
content-type: application/javascript
content-length: 218
set-cookie: PHPSESSID=4il2mhvsne1tdd30dn1lno0a30; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RjKLPUfLK7LwSD%2Fdy8rpirpdPL8P%2Fj2mR6K%2BfYgNdz4URVuc%2FNOtTf4cgD4rOeXIOn4rrDWJNjrb9rQC84QPwQWB0KKw3y36ctUaJ92HMBqgiUI7F6PMicppS0JUQ%2BwymxEiaKZvLdw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881c11630bdc7128-OSL
X-Firefox-Spdy: h2
|
|
| ads.bisniskini.biz.id/get/site/js/cb1f929c7c7c523575650f47146f231e | 172.67.214.128 | 200 OK | 222 B |
URL GET HTTP/2ads.bisniskini.biz.id/get/site/js/cb1f929c7c7c523575650f47146f231e IP172.67.214.128:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectbisniskini.biz.id FingerprintCB:C5:50:71:58:97:D7:6D:B9:8F:63:0E:B9:30:B7:87:1D:05:E2:5A ValiditySun, 14 Apr 2024 15:48:05 GMT - Sat, 13 Jul 2024 15:48:04 GMT
File typeASCII text, with CRLF line terminators Hash252b107927cd0781f0972fac6f9f4f8f ce31eb7d65808aa4fae8620ffabf7c40cc077b77 8d6a0836a8d3ca9e64038e97232c4c8e1442635523e33c3d07f7e204ce125ee2
GET /get/site/js/cb1f929c7c7c523575650f47146f231e HTTP/1.1
Host: ads.bisniskini.biz.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:14 GMT
content-type: application/javascript
content-length: 222
set-cookie: PHPSESSID=4h7urglbsqmj3gmdh88t852tht; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hBg%2BO8Zl4U9pc8Mp1EbK6I1MZVzJT4PD%2F5vaL0QEsmaOOHKWCnLViyDPfjgD7FFWig3hBmCEdNEbwmt0gI30bK0XTmJeH6D4U%2BPHasdNiTFei9%2BzSc%2B6%2FQoyUbU7JICLwpxOMcpMRP0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881c1162fbc87128-OSL
X-Firefox-Spdy: h2
|
|
| ads.bisniskini.biz.id/get/site/js/d6f51a1ed1d2f145512197f7cd7be46d | 172.67.214.128 | 200 OK | 218 B |
URL GET HTTP/2ads.bisniskini.biz.id/get/site/js/d6f51a1ed1d2f145512197f7cd7be46d IP172.67.214.128:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectbisniskini.biz.id FingerprintCB:C5:50:71:58:97:D7:6D:B9:8F:63:0E:B9:30:B7:87:1D:05:E2:5A ValiditySun, 14 Apr 2024 15:48:05 GMT - Sat, 13 Jul 2024 15:48:04 GMT
File typeASCII text, with CRLF line terminators Hash53d76623d9d99464e544bae28620f09f 15762f2bde793d241f10807442f825e8b732b501 0aae87e7770c472eaf96f99fc7c6d0c6fb29815cba1734f672af54d5f24e3400
GET /get/site/js/d6f51a1ed1d2f145512197f7cd7be46d HTTP/1.1
Host: ads.bisniskini.biz.id
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:14 GMT
content-type: application/javascript
content-length: 218
set-cookie: PHPSESSID=12nej1396sm7e3fc7ac5tckgrv; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ohwg%2FyT2FB7OlwOzTZlZ3%2BRKr82JqK7CxlE2uMxyz7xIyV0hHo2re2WgybJdjR586M4WftJ%2FNKuxYbj7HSrAdNyUvq88gTlTKrpi3HnbgzeayIAPYnm9KBjfUG0MjTtdFHl8c1JQvuI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881c11630bda7128-OSL
X-Firefox-Spdy: h2
|
|
| www.topcreativeformat.com/d64164e145fb760de2b76872de4432d8/invoke.js | 192.243.59.13 | 200 OK | 12 kB |
URL GET HTTP/1.1www.topcreativeformat.com/d64164e145fb760de2b76872de4432d8/invoke.js IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjecttopcreativeformat.com Fingerprint6D:98:D9:61:FC:CF:D9:8C:FE:5E:1C:15:5A:A5:F2:28:38:04:A4:A4 ValidityWed, 20 Mar 2024 07:51:41 GMT - Tue, 18 Jun 2024 07:51:40 GMT
File typeJavaScript source, ASCII text, with very long lines (31319), with no line terminators Hashd21afa382360601a4ead990353433a5b 521e5587e5710cf14a79cac94b96ccc8b3226b60 a9dd517899c052c56b746e482fea2a17745d2ee62dcd55a8103e302190c35d98
GET /d64164e145fb760de2b76872de4432d8/invoke.js HTTP/1.1
Host: www.topcreativeformat.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b5ade11b0caf751baa5a891eb2ca112e
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| www.topcreativeformat.com/872eda8cdc00d65d8016b8e6fba2d29b/invoke.js | 192.243.59.13 | 200 OK | 12 kB |
URL GET HTTP/1.1www.topcreativeformat.com/872eda8cdc00d65d8016b8e6fba2d29b/invoke.js IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjecttopcreativeformat.com Fingerprint6D:98:D9:61:FC:CF:D9:8C:FE:5E:1C:15:5A:A5:F2:28:38:04:A4:A4 ValidityWed, 20 Mar 2024 07:51:41 GMT - Tue, 18 Jun 2024 07:51:40 GMT
File typeJavaScript source, ASCII text, with very long lines (31292), with no line terminators Hashca9eee6ce387cbe21bea0415bf2595a2 ea52a8b9530fb9e2e133a3fb10e7245fb0a8829e fbccf52cdd037fb0e85aec55ddcc6ab9bd8cd05662f1f6e1b1ca15107b4e94a5
GET /872eda8cdc00d65d8016b8e6fba2d29b/invoke.js HTTP/1.1
Host: www.topcreativeformat.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 97cb396534cefd00fe584483e625488d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| proftrafficcounter.com/stats |  3.124.83.201 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP3.124.83.201:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hashdf7254c9e77ba34abe44e224c7134425 b4dc6ce8b2c50ee1581d002d9f1d24b3f537e820 1bdfbe4d2efff2f6297de261594cd17db19e28ce5202efea014a83cddac8c7b2
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:15 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://nathanielportoryxj0m02ml.pages.dev
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; expires=Mon, 08 May 2034 18:42:15 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| proftrafficcounter.com/stats | 3.124.83.201 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP3.124.83.201:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hashdf7254c9e77ba34abe44e224c7134425 b4dc6ce8b2c50ee1581d002d9f1d24b3f537e820 1bdfbe4d2efff2f6297de261594cd17db19e28ce5202efea014a83cddac8c7b2
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Cookie: uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:15 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://nathanielportoryxj0m02ml.pages.dev
vary: Origin
access-control-allow-credentials: true
X-Firefox-Spdy: h2
|
|
| herringgloomilytennis.com/watch.1277338205499.js?key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 172.240.108.84 | 307 Temporary Redirect | 0 B |
URL GET HTTP/1.1herringgloomilytennis.com/watch.1277338205499.js?key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP172.240.108.84:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectherringgloomilytennis.com Fingerprint2A:E0:3F:2A:77:92:96:90:5D:38:27:4E:7F:FC:5D:D2:F9:32:73:11 ValidityMon, 06 May 2024 08:10:21 GMT - Sun, 04 Aug 2024 08:10:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.1277338205499.js?key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: herringgloomilytennis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Location: https://herringgloomilytennis.com/watch.1277338205499.js?dev=e&key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=c3bb56975bcb3398921af657e0a64ca92ef0794984907386aba320d3735e96c6a68239ccdcc350b2d026e7c13d94b9966d779743fc2046092bffab8f9fe651bd4620d04f8d2314b858fb6774a5564e7925552c94264423e823c97183dcc7d8&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1
Set-Cookie: u_pl=23149106; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0OTEwNiwiayI6ImQ2NDE2NGUxNDVmYjc2MGRlMmI3Njg3MmRlNDQzMmQ4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyMywicHQiOjQsInBrIjoicTN2cHlkeXh1IiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.RkgTD9-H0-kEfbCWYLXLnT_T2W2m-ucVevAC8ZYr5ls; expires=Fri, 10 May 2024 18:43:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2705391470bb86116aec1b5203dddef5
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| pl23249615.highcpmgate.com/36/35/24/36352469ba20ff8ade54795907dd51e5.js | 192.243.59.20 | 200 OK | 16 kB |
URL GET HTTP/1.1pl23249615.highcpmgate.com/36/35/24/36352469ba20ff8ade54795907dd51e5.js IP192.243.59.20:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjecthighcpmgate.com FingerprintE7:53:32:23:DA:D6:BE:EB:98:90:05:4B:AC:AC:8C:89:F2:4D:FB:2E ValidityFri, 19 Apr 2024 10:31:16 GMT - Thu, 18 Jul 2024 10:31:15 GMT
File typeJavaScript source, ASCII text, with very long lines (44052), with no line terminators Hash15456f1a79f8d9f4931e207259fbcaad c6aedf604dbc8d46586e3bf483884804fe334b30 6d7314f76e50b91c0c3f06bd029bf9278f9ae30e3d6b69b39b1f2d22f294934e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /36/35/24/36352469ba20ff8ade54795907dd51e5.js HTTP/1.1
Host: pl23249615.highcpmgate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8383cc2a107bf4b5854441e56957683d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| restlessidea.com/watch.578188880334.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 192.243.59.13 | 307 Temporary Redirect | 0 B |
URL GET HTTP/1.1restlessidea.com/watch.578188880334.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectrestlessidea.com FingerprintF1:1A:4C:F2:E9:86:B0:2E:A7:9E:26:57:D2:56:53:84:4B:25:CA:CD ValidityMon, 06 May 2024 08:16:28 GMT - Sun, 04 Aug 2024 08:16:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.578188880334.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: restlessidea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Location: https://restlessidea.com/watch.578188880334.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=74ab4c13c28194e27901836c05a7b7f0b1c65e390cddb3de987082d22decfd1f2d391e2638890534f8268b056433aeb786c8ec1a0a97b8f435331ba7951cafc7f36ecfa4e52a50a963114960e7541ace70b799&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1
Set-Cookie: u_pl=23148904; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0ODkwNCwiayI6Ijg3MmVkYThjZGMwMGQ2NWQ4MDE2YjhlNmZiYTJkMjliIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJzcTU1MTZuN2FmIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.9zX8wWLH2dgH1hsj7XqLg5mJA6e0ZweIhzxMZjBYsb4; expires=Fri, 10 May 2024 18:43:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ebfb2041e66069d5c3f525c0cb30f2be
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| herringgloomilytennis.com/watch.1277338205499.js?dev=e&key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=c3bb56975bcb3398921af657e0a64ca92ef0794984907386aba320d3735e96c6a68239ccdcc350b2d026e7c13d94b9966d779743fc2046092bffab8f9fe651bd4620d04f8d2314b858fb6774a5564e7925552c94264423e823c97183dcc7d8&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 172.240.108.84 | 200 OK | 2.1 kB |
URL GET HTTP/1.1herringgloomilytennis.com/watch.1277338205499.js?dev=e&key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=c3bb56975bcb3398921af657e0a64ca92ef0794984907386aba320d3735e96c6a68239ccdcc350b2d026e7c13d94b9966d779743fc2046092bffab8f9fe651bd4620d04f8d2314b858fb6774a5564e7925552c94264423e823c97183dcc7d8&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP172.240.108.84:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectherringgloomilytennis.com Fingerprint2A:E0:3F:2A:77:92:96:90:5D:38:27:4E:7F:FC:5D:D2:F9:32:73:11 ValidityMon, 06 May 2024 08:10:21 GMT - Sun, 04 Aug 2024 08:10:20 GMT
File typeJavaScript source, ASCII text, with very long lines (2623) Hashf477f23917fb57bc9894b3aba3f194d8 ec42c0802008807acff8dc8a589a97f2b78f5eee f995205913c8147b3660cc0eb2dae93808fea4a47eab0eed0d7b435945d99f41
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.1277338205499.js?dev=e&key=d64164e145fb760de2b76872de4432d8&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=c3bb56975bcb3398921af657e0a64ca92ef0794984907386aba320d3735e96c6a68239ccdcc350b2d026e7c13d94b9966d779743fc2046092bffab8f9fe651bd4620d04f8d2314b858fb6774a5564e7925552c94264423e823c97183dcc7d8&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: herringgloomilytennis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nathanielportoryxj0m02ml.pages.dev
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149106; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0OTEwNiwiayI6ImQ2NDE2NGUxNDVmYjc2MGRlMmI3Njg3MmRlNDQzMmQ4Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyMywicHQiOjQsInBrIjoicTN2cHlkeXh1IiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.RkgTD9-H0-kEfbCWYLXLnT_T2W2m-ucVevAC8ZYr5ls
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; expires=Fri, 17 May 2024 18:42:15 GMT; secure; SameSite=None
iprccf197293549259068a19ad2e25f81bf5=3569808; expires=Fri, 10 May 2024 22:42:15 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
uncs=1; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
pdhtkv23=true; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
uncs23=1; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2cb1508678e32324b9ed3804c848f7bf
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| www.topcreativeformat.com/872eda8cdc00d65d8016b8e6fba2d29b/invoke.js | 192.243.59.13 | 200 OK | 12 kB |
URL GET HTTP/1.1www.topcreativeformat.com/872eda8cdc00d65d8016b8e6fba2d29b/invoke.js IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjecttopcreativeformat.com Fingerprint6D:98:D9:61:FC:CF:D9:8C:FE:5E:1C:15:5A:A5:F2:28:38:04:A4:A4 ValidityWed, 20 Mar 2024 07:51:41 GMT - Tue, 18 Jun 2024 07:51:40 GMT
File typeJavaScript source, ASCII text, with very long lines (31307), with no line terminators Hashbcfdd1ab32c40d917604d6ae639e1990 cf119c4e6678d10776f07e2c4326cff9ef8ff005 288f9275153d93240c08bd9e2771c8d334fede0cf7adaf56f3bf31fcbd9b7038
GET /872eda8cdc00d65d8016b8e6fba2d29b/invoke.js HTTP/1.1
Host: www.topcreativeformat.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fe443f6e52fbdae637835ef206b7cf56
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| restlessidea.com/watch.578188880334.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=74ab4c13c28194e27901836c05a7b7f0b1c65e390cddb3de987082d22decfd1f2d391e2638890534f8268b056433aeb786c8ec1a0a97b8f435331ba7951cafc7f36ecfa4e52a50a963114960e7541ace70b799&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 192.243.59.13 | 200 OK | 2.0 kB |
URL GET HTTP/1.1restlessidea.com/watch.578188880334.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=74ab4c13c28194e27901836c05a7b7f0b1c65e390cddb3de987082d22decfd1f2d391e2638890534f8268b056433aeb786c8ec1a0a97b8f435331ba7951cafc7f36ecfa4e52a50a963114960e7541ace70b799&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP192.243.59.13:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectrestlessidea.com FingerprintF1:1A:4C:F2:E9:86:B0:2E:A7:9E:26:57:D2:56:53:84:4B:25:CA:CD ValidityMon, 06 May 2024 08:16:28 GMT - Sun, 04 Aug 2024 08:16:27 GMT
File typeJavaScript source, ASCII text, with very long lines (2420) Hash17189d2aaa010c3e93a731b342ee9f1f 4ff6336bb8bd803663753ac214faabd11ed25fb5 3b7e62233f7e1d6c66330f9daae0c17fad8c3a8ba5160876acc402943feb9ff5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.578188880334.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366595&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=74ab4c13c28194e27901836c05a7b7f0b1c65e390cddb3de987082d22decfd1f2d391e2638890534f8268b056433aeb786c8ec1a0a97b8f435331ba7951cafc7f36ecfa4e52a50a963114960e7541ace70b799&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: restlessidea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nathanielportoryxj0m02ml.pages.dev
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23148904; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0ODkwNCwiayI6Ijg3MmVkYThjZGMwMGQ2NWQ4MDE2YjhlNmZiYTJkMjliIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJzcTU1MTZuN2FmIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.9zX8wWLH2dgH1hsj7XqLg5mJA6e0ZweIhzxMZjBYsb4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 10 May 2024 18:42:15 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; expires=Fri, 17 May 2024 18:42:15 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
uncs=1; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
pdhtkv5=true; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
uncs5=1; expires=Sat, 11 May 2024 18:42:15 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 67eda3240a2aecb2652da6fb10ec3575
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| tse1.mm.bing.net/th?q= | 204.79.197.200 | 404 Not Found | 727 B |
IP204.79.197.200:443 ASN#8068 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerMicrosoft Corporation Subjectwww.bing.com Fingerprint02:83:27:F9:50:D8:BE:B9:5E:DF:1A:4A:45:3B:6D:3C:BC:30:F2:58 ValidityWed, 01 May 2024 01:58:25 GMT - Thu, 27 Jun 2024 23:59:59 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, baseline, precision 8, 80x80, components 3 Hash5116706c119475f5ae2fc135c3358037 7e5bdf3585153e317ebef05a9b8241d311e44cb3 7edda2585f580c167fd4e3a6c162534548cda437f8bef67c544f3aa9c162a17c
GET /th?q= HTTP/1.1
Host: tse1.mm.bing.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cache-control: no-cache
pragma: no-cache
content-length: 727
expires: -1
x-cache: TCP_MISS
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 692B6E2F68A94130997F477DEBB6555D Ref B: OSL30EDGE0106 Ref C: 2024-05-10T18:42:16Z
date: Fri, 10 May 2024 18:42:16 GMT
X-Firefox-Spdy: h2
|
|
| downstairsnegotiatebarren.com/sfp.js |  188.114.97.1 | 200 OK | 28 kB |
URL GET HTTP/2downstairsnegotiatebarren.com/sfp.js IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectdownstairsnegotiatebarren.com Fingerprint5D:DB:CB:C6:CE:2A:8B:34:7D:BC:43:74:33:1D:5F:77:48:F7:BC:1B ValidityThu, 02 May 2024 21:26:34 GMT - Wed, 31 Jul 2024 21:26:33 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators Hashf4a2f8f9f99541c6f105bbd0a025bd40 1f8e3eff12168fdd9e719adfc098d24a45b6916a b717cb04231a10d425fd55b73c85a5407119c6826a8bac94142fddfff6958716
GET /sfp.js HTTP/1.1
Host: downstairsnegotiatebarren.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:16 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 97fa33222adbb81e05dec73fcd6cc40d
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 10 May 2024 18:42:15 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=arucXjDtDkvdL8QTVAai%2FrErk9vVePQJTMKIKVTK3pX3PLhAhVuQ21y94daPZxnfSFGUh9CF0W9k9M417FAXY4SOtFMHtVWRhtu%2FAoiUw79IuzxknGMijIErOsy0Z%2FAuYHJrg%2FeIOQ5%2Bf9eL2U6dgA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c11717cfd712f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| selfevidentvisual.com/watch.520036182796.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 172.240.127.234 | 307 Temporary Redirect | 0 B |
URL GET HTTP/1.1selfevidentvisual.com/watch.520036182796.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP172.240.127.234:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectselfevidentvisual.com Fingerprint67:06:8B:12:1D:E0:78:04:09:96:B8:2C:9B:E1:75:AB:5F:7A:A1:AD ValidityMon, 06 May 2024 12:44:12 GMT - Sun, 04 Aug 2024 12:44:11 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.520036182796.js?key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&tz=0&dev=e&res=14.2071&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: selfevidentvisual.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 307 Temporary Redirect
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:16 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Location: https://selfevidentvisual.com/watch.520036182796.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366596&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=5f4cf1da860ca3b539006631d2c1516d8ba6e7daef9cb4c74504fb269684b0c4e2ff4577b8f795cc40e0525da2e863e5f5a171a03656010ddc65b8f7375dccf0c74beadd9589dffbffcc5c7d5064201e5aaa88b0c55d349a67748f35079419b251&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1
Set-Cookie: u_pl=23148904; expires=Sat, 11 May 2024 18:42:16 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0ODkwNCwiayI6Ijg3MmVkYThjZGMwMGQ2NWQ4MDE2YjhlNmZiYTJkMjliIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJzcTU1MTZuN2FmIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.9zX8wWLH2dgH1hsj7XqLg5mJA6e0ZweIhzxMZjBYsb4; expires=Fri, 10 May 2024 18:43:16 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 023f910dd49015119bf4537f5aabe14d
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.cloudimagesb.com/cti/5c/10/b0/5c10b0b28e7a0e9d7e61bd8d09bee3db/1658920078.png | 45.133.44.10 | 200 OK | 106 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/5c/10/b0/5c10b0b28e7a0e9d7e61bd8d09bee3db/1658920078.png IP45.133.44.10:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 728 x 90, 8-bit/color RGBA, non-interlaced Size106 kB (105910 bytes) Hasha36b92bb68d9b579458560ba9b94862a 782d2932ccd3a56e5aad1cca7e6e7fb4a3cf23d6 9de12cf85ad80cae34d8bdaeb59169d75e3bd4f8b931ec90ea2c3be166647c0e
GET /cti/5c/10/b0/5c10b0b28e7a0e9d7e61bd8d09bee3db/1658920078.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:16 GMT
content-type: image/png
content-length: 105910
server: nginx/1.21.6
last-modified: Wed, 27 Jul 2022 11:08:06 GMT
etag: "62e11c96-19db6"
expires: Sun, 12 May 2024 18:42:16 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| cdn.cloudimagesb.com/cti/c5/42/45/c54245f4d3810d4d3ce60ca261d6646e/1708072465.png | 45.133.44.10 | 200 OK | 17 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/c5/42/45/c54245f4d3810d4d3ce60ca261d6646e/1708072465.png IP45.133.44.10:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced Hashebb2d660b0d32a47cd086320e0e0d66f ccc3eb4da1eb64e5729f6174ebd3a1ecae2e9eca 7380162c7f0cb3143a8abce1404574da9ac0e0a42a33361df98e85a1ee4fdaad
GET /cti/c5/42/45/c54245f4d3810d4d3ce60ca261d6646e/1708072465.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:16 GMT
content-type: image/png
content-length: 17397
server: nginx/1.21.6
last-modified: Fri, 16 Feb 2024 08:34:33 GMT
etag: "65cf1e19-43f5"
expires: Sun, 12 May 2024 18:42:16 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| selfevidentvisual.com/watch.520036182796.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366596&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=5f4cf1da860ca3b539006631d2c1516d8ba6e7daef9cb4c74504fb269684b0c4e2ff4577b8f795cc40e0525da2e863e5f5a171a03656010ddc65b8f7375dccf0c74beadd9589dffbffcc5c7d5064201e5aaa88b0c55d349a67748f35079419b251&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 172.240.127.234 | 200 OK | 2.0 kB |
URL GET HTTP/1.1selfevidentvisual.com/watch.520036182796.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366596&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=5f4cf1da860ca3b539006631d2c1516d8ba6e7daef9cb4c74504fb269684b0c4e2ff4577b8f795cc40e0525da2e863e5f5a171a03656010ddc65b8f7375dccf0c74beadd9589dffbffcc5c7d5064201e5aaa88b0c55d349a67748f35079419b251&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP172.240.127.234:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectselfevidentvisual.com Fingerprint67:06:8B:12:1D:E0:78:04:09:96:B8:2C:9B:E1:75:AB:5F:7A:A1:AD ValidityMon, 06 May 2024 12:44:12 GMT - Sun, 04 Aug 2024 12:44:11 GMT
File typeJavaScript source, ASCII text, with very long lines (2447) Hash5df35556a437fb7e69e6df94361d2eec 8557d441fd334049bc94f5f4e7ef57f509a2cee8 165489b9fedd0143a5d8943192a3f454194bb0761ba43d2283656467eb0232fc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /watch.520036182796.js?dev=e&key=872eda8cdc00d65d8016b8e6fba2d29b&kw=%5B%5D&pst=1715366596&refer=https%3A%2F%2Fnathanielportoryxj0m02ml.pages.dev%2F&res=14.2071&rmtc=t&shu=5f4cf1da860ca3b539006631d2c1516d8ba6e7daef9cb4c74504fb269684b0c4e2ff4577b8f795cc40e0525da2e863e5f5a171a03656010ddc65b8f7375dccf0c74beadd9589dffbffcc5c7d5064201e5aaa88b0c55d349a67748f35079419b251&tz=0&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: selfevidentvisual.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nathanielportoryxj0m02ml.pages.dev
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23148904; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMzE0ODkwNCwiayI6Ijg3MmVkYThjZGMwMGQ2NWQ4MDE2YjhlNmZiYTJkMjliIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozODIyNDk2LCJwaWQiOjE4NDI2NzQsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjo1LCJwdCI6NCwicGsiOiJzcTU1MTZuN2FmIiwidCI6MX0sInUiOnsidSI6MSwiYXUiOjEsImQiOnsiaWQiOjc5OTU0MTk2LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wLEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6MTgxMTAsIm9uIjoiTGludXgiLCJvdiI6IlVua25vd24iLCJiaWQiOjExNjY3MCwiYm4iOiJGaXJlZm94IiwiYnYiOiI5Ni4wIiwid3YiOmZhbHNlLCJlIjp0cnVlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoxNjIsImMiOiJOTyIsIm4iOiJOb3J3YXkifSwiYSI6ZmFsc2UsImNyIjp7Im4iOiJCbGl4IFNvbHV0aW9ucyJ9LCJ4ZiI6IiIsIml4ZiI6ZmFsc2UsImlneGYiOmZhbHNlLCJ1cCI6dHJ1ZSwiciI6Imh0dHBzOi8vbmF0aGFuaWVscG9ydG9yeXhqMG0wMm1sLnBhZ2VzLmRldi8iLCJhciI6W119fQ.9zX8wWLH2dgH1hsj7XqLg5mJA6e0ZweIhzxMZjBYsb4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:16 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; expires=Fri, 17 May 2024 18:42:16 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 11 May 2024 18:42:16 GMT; secure; SameSite=None
uncs=1; expires=Sat, 11 May 2024 18:42:16 GMT; secure; SameSite=None
pdhtkv5=true; expires=Sat, 11 May 2024 18:42:16 GMT; secure; SameSite=None
uncs5=1; expires=Sat, 11 May 2024 18:42:16 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7dceef3163e081a49a032ba1abc0015d
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| cdn.cloudimagesb.com/cti/bd/40/19/bd4019b6dcef73a1f96bc4593c321e11/1707725903.png | 45.133.44.10 | 200 OK | 63 kB |
URL GET HTTP/2cdn.cloudimagesb.com/cti/bd/40/19/bd4019b6dcef73a1f96bc4593c321e11/1707725903.png IP45.133.44.10:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 300 x 250, 8-bit/color RGBA, non-interlaced Hash5942ffc6b6a9c37ff916a6a75f8e56cf 4660db02422b646fe368c795a3dcf8fa1ef97ce5 0acbcb3c359cff614a772250f6475c3c44c1a32a13e6b1996f5cfbc6ea80ee0d
GET /cti/bd/40/19/bd4019b6dcef73a1f96bc4593c321e11/1707725903.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: image/png
content-length: 63346
server: nginx/1.21.6
last-modified: Mon, 12 Feb 2024 08:18:33 GMT
etag: "65c9d459-f772"
expires: Sun, 12 May 2024 18:42:17 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| sprangsugar.com/sbar.json?key=36352469ba20ff8ade54795907dd51e5&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 | 192.243.61.227 | 200 OK | 8.3 kB |
URL GET HTTP/1.1sprangsugar.com/sbar.json?key=36352469ba20ff8ade54795907dd51e5&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hash1caccda25fe7a6f48b114c854358beee 7a64d3374f03d8bd09c0f4c8e2469998a412389e 10b97c140fb430a60e6c49c8425e0a4576839b579457934f9640a9fd7f5138c4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /sbar.json?key=36352469ba20ff8ade54795907dd51e5&uuid=f29918b1-072d-4ac3-979b-45347dc11738%3A2%3A1 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Origin: https://nathanielportoryxj0m02ml.pages.dev
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=23149116; expires=Sat, 11 May 2024 18:42:17 GMT; secure; SameSite=None
uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; expires=Fri, 17 May 2024 18:42:17 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 11 May 2024 18:42:17 GMT; secure; SameSite=None
uncs=1; expires=Sat, 11 May 2024 18:42:17 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sat, 11 May 2024 18:42:17 GMT; secure; SameSite=None
uncs29=1; expires=Sat, 11 May 2024 18:42:17 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 094984b64d62162c393bf4f591d72d92
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| sprangsugar.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSwW8bxReedXL7ST8J1Fup5AOHIhFnd23velNERQhBEaEpTRHc0OzOrjP17M5qZsfr5IAiKqFys%2FgLNp%2BTRpQKtVckKuRU4hAJqeaUA7nwHxSpZ2RjYXiHee%2FN9430zffe10fmkrgw9GLjY3nAhaCr7YZdv%2F6549yob%2FPMDOqDjveF17pRV%2F21wGvYb9U%2FjKOeXHVtx7Yd26lvchUncrA6BcHzx4HTCOxGy2047RYG6r%2B9NhY0tcD6l%2BR1cDZZfm5dAY%2FGyNInG7HuFTJ%2F%2B4PUCFpIhT47%2FTTrZbLMkC7KRFlIstM5G1K%2F2HwGmZ3M5EL2%2FyGGfEKsX54hzE7nIhH2j2c6Q4E4Q8j%2Bh7I%2FRizG4HSMSN4HZy8IEDHc2kGWPrwlVUn3%2F0bpFJ2Q5Vd%2FgpcTsvz7FWTpD%2BuCD%2Bq7UpiCy0xjkFTggzF4d4zcnKE4qIGXZ4iKr8DZr2T11Tay9HhHCwnOLt5M3CBwOqGzYvsuW2nRqLkS%2BEG40mo3Wz6LHMdvdmYGcT4GT8YQ8RBU12C0BcMtmMSCyS2k7KIeOY7j2yyidieIoibz49BjtkP9xKGO7XVgoukfhijyISIxRKQOkatD9PgQyvwMvVdBs2XoYkKsT75En1UoY4JSE5SUoOQEZUFQ9qsTJrSrq4dMaBM68%2BzOc7MayaJ7RE9k0Y0zAqqGUKw6yi%2FJa1MTLbr2DnrxRb3pNdtuywtC6tpJ0qEsbrf8oB3YPmNtJ25D8wpc10C1hQM%2BIWu7FXI%2BIW9ce4mQnkGLM0R8CdRcAy0r0L0KB9mjjPKeFI1IpmCyQl4so9i3jsQluTob4tbOE8TR%2Bc0%2FmrNApCrkqsI9%2FpygKx6M7siSHN%2BRpSZPd%2FKCp%2FyATge8W9AiXnr0UbxfSsW2NvTwu%2FeiKTAtH9%2BNdbFNM8azribfr3PGYrUpVRSTn7b0Z3F42%2Bi9daMyk2%2Fffn9zK81VrDWX2Rh0uqsvFSI%2BIf%2B%2Fene2u9d%2F3AFXYyhTITXnZB7gcowoP4TOF%2Fq1JFBiwQlzC6WpRsoNF5eCE4h40dOwgv5XHy7qkaLT15RXR%2FoBuqoGWtxHllboqwp9UYGKIbRZGhW5Or%2F521xGKGqjUKjacSiU%2BHZm8%2FR4Cs0v6n6zaVMvaDu%2BT2M%2FbLmdxHMYpW7Lcz2PNlHoSfLuvW%2F%2BAgAA%2F%2F8BAAD%2F%2F7X0CqWVBAAA | 192.243.61.227 | 200 OK | 7 B |
URL GET HTTP/1.1sprangsugar.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSwW8bxReedXL7ST8J1Fup5AOHIhFnd23velNERQhBEaEpTRHc0OzOrjP17M5qZsfr5IAiKqFys%2FgLNp%2BTRpQKtVckKuRU4hAJqeaUA7nwHxSpZ2RjYXiHee%2FN9430zffe10fmkrgw9GLjY3nAhaCr7YZdv%2F6549yob%2FPMDOqDjveF17pRV%2F21wGvYb9U%2FjKOeXHVtx7Yd26lvchUncrA6BcHzx4HTCOxGy2047RYG6r%2B9NhY0tcD6l%2BR1cDZZfm5dAY%2FGyNInG7HuFTJ%2F%2B4PUCFpIhT47%2FTTrZbLMkC7KRFlIstM5G1K%2F2HwGmZ3M5EL2%2FyGGfEKsX54hzE7nIhH2j2c6Q4E4Q8j%2Bh7I%2FRizG4HSMSN4HZy8IEDHc2kGWPrwlVUn3%2F0bpFJ2Q5Vd%2FgpcTsvz7FWTpD%2BuCD%2Bq7UpiCy0xjkFTggzF4d4zcnKE4qIGXZ4iKr8DZr2T11Tay9HhHCwnOLt5M3CBwOqGzYvsuW2nRqLkS%2BEG40mo3Wz6LHMdvdmYGcT4GT8YQ8RBU12C0BcMtmMSCyS2k7KIeOY7j2yyidieIoibz49BjtkP9xKGO7XVgoukfhijyISIxRKQOkatD9PgQyvwMvVdBs2XoYkKsT75En1UoY4JSE5SUoOQEZUFQ9qsTJrSrq4dMaBM68%2BzOc7MayaJ7RE9k0Y0zAqqGUKw6yi%2FJa1MTLbr2DnrxRb3pNdtuywtC6tpJ0qEsbrf8oB3YPmNtJ25D8wpc10C1hQM%2BIWu7FXI%2BIW9ce4mQnkGLM0R8CdRcAy0r0L0KB9mjjPKeFI1IpmCyQl4so9i3jsQluTob4tbOE8TR%2Bc0%2FmrNApCrkqsI9%2FpygKx6M7siSHN%2BRpSZPd%2FKCp%2FyATge8W9AiXnr0UbxfSsW2NvTwu%2FeiKTAtH9%2BNdbFNM8azribfr3PGYrUpVRSTn7b0Z3F42%2Bi9daMyk2%2Fffn9zK81VrDWX2Rh0uqsvFSI%2BIf%2B%2Fene2u9d%2F3AFXYyhTITXnZB7gcowoP4TOF%2Fq1JFBiwQlzC6WpRsoNF5eCE4h40dOwgv5XHy7qkaLT15RXR%2FoBuqoGWtxHllboqwp9UYGKIbRZGhW5Or%2F521xGKGqjUKjacSiU%2BHZm8%2FR4Cs0v6n6zaVMvaDu%2BT2M%2FbLmdxHMYpW7Lcz2PNlHoSfLuvW%2F%2BAgAA%2F%2F8BAAD%2F%2F7X0CqWVBAAA IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSwW8bxReedXL7ST8J1Fup5AOHIhFnd23velNERQhBEaEpTRHc0OzOrjP17M5qZsfr5IAiKqFys%2FgLNp%2BTRpQKtVckKuRU4hAJqeaUA7nwHxSpZ2RjYXiHee%2FN9430zffe10fmkrgw9GLjY3nAhaCr7YZdv%2F6549yob%2FPMDOqDjveF17pRV%2F21wGvYb9U%2FjKOeXHVtx7Yd26lvchUncrA6BcHzx4HTCOxGy2047RYG6r%2B9NhY0tcD6l%2BR1cDZZfm5dAY%2FGyNInG7HuFTJ%2F%2B4PUCFpIhT47%2FTTrZbLMkC7KRFlIstM5G1K%2F2HwGmZ3M5EL2%2FyGGfEKsX54hzE7nIhH2j2c6Q4E4Q8j%2Bh7I%2FRizG4HSMSN4HZy8IEDHc2kGWPrwlVUn3%2F0bpFJ2Q5Vd%2FgpcTsvz7FWTpD%2BuCD%2Bq7UpiCy0xjkFTggzF4d4zcnKE4qIGXZ4iKr8DZr2T11Tay9HhHCwnOLt5M3CBwOqGzYvsuW2nRqLkS%2BEG40mo3Wz6LHMdvdmYGcT4GT8YQ8RBU12C0BcMtmMSCyS2k7KIeOY7j2yyidieIoibz49BjtkP9xKGO7XVgoukfhijyISIxRKQOkatD9PgQyvwMvVdBs2XoYkKsT75En1UoY4JSE5SUoOQEZUFQ9qsTJrSrq4dMaBM68%2BzOc7MayaJ7RE9k0Y0zAqqGUKw6yi%2FJa1MTLbr2DnrxRb3pNdtuywtC6tpJ0qEsbrf8oB3YPmNtJ25D8wpc10C1hQM%2BIWu7FXI%2BIW9ce4mQnkGLM0R8CdRcAy0r0L0KB9mjjPKeFI1IpmCyQl4so9i3jsQluTob4tbOE8TR%2Bc0%2FmrNApCrkqsI9%2FpygKx6M7siSHN%2BRpSZPd%2FKCp%2FyATge8W9AiXnr0UbxfSsW2NvTwu%2FeiKTAtH9%2BNdbFNM8azribfr3PGYrUpVRSTn7b0Z3F42%2Bi9daMyk2%2Fffn9zK81VrDWX2Rh0uqsvFSI%2BIf%2B%2Fene2u9d%2F3AFXYyhTITXnZB7gcowoP4TOF%2Fq1JFBiwQlzC6WpRsoNF5eCE4h40dOwgv5XHy7qkaLT15RXR%2FoBuqoGWtxHllboqwp9UYGKIbRZGhW5Or%2F521xGKGqjUKjacSiU%2BHZm8%2FR4Cs0v6n6zaVMvaDu%2BT2M%2FbLmdxHMYpW7Lcz2PNlHoSfLuvW%2F%2BAgAA%2F%2F8BAAD%2F%2F7X0CqWVBAAA HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8611b8f202af688a37a3ef2469de88ac
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| shayscholz.blogspot.com/favicon.ico | 216.58.207.193 | | 412 B |
URL GET shayscholz.blogspot.com/favicon.ico IP216.58.207.193:0
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectmisc-sni.blogspot.com FingerprintC4:7D:61:88:AB:F1:15:A1:36:2A:68:39:51:62:46:00:23:6D:39:00 ValidityTue, 16 Apr 2024 03:45:20 GMT - Tue, 09 Jul 2024 03:45:19 GMT
File typeMS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel Hash59a0c7b6e4848ccdabcea0636efda02b 30ef5c54b8bbc3487ea2b4c45cd11ea2932e4340 a1495da3cf3db37bf105a12658636ff628fee7b73975b9200049af7747e60b1f
GET /favicon.ico HTTP/1.1
Host: shayscholz.blogspot.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-security-policy: upgrade-insecure-requests
content-security-policy-report-only: default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-to blogspot; report-uri https://www.blogger.com/cspreport
report-to: {"group":"blogspot","max_age":2592000,"endpoints":[{"url":"https://www.blogger.com/cspreport"}]}
content-type: image/x-icon
expires: Fri, 10 May 2024 18:42:17 GMT
date: Fri, 10 May 2024 18:42:17 GMT
cache-control: private, max-age=86400
last-modified: Fri, 08 Mar 2024 19:12:27 GMT
etag: W/"53e1bb00e6929e879a040ee00d8ddd9c6a9b1f6c6c79cd1077a9390901619218"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 412
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.barscreative1.com/sb/au/2f/33/17/2f3317da28d2a6ed09610d2d267aa136/1648542458.html | 45.133.44.4 | 200 OK | 661 B |
URL GET HTTP/2cdn.barscreative1.com/sb/au/2f/33/17/2f3317da28d2a6ed09610d2d267aa136/1648542458.html IP45.133.44.4:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectcdn.barscreative1.com Fingerprint08:55:F0:C8:EA:24:54:0D:3C:B9:2C:95:3E:DC:BF:FB:A8:76:BA:BC ValidityThu, 09 May 2024 03:01:15 GMT - Wed, 07 Aug 2024 03:01:14 GMT
File typeHTML document, ASCII text Hash027fddd0d322239ada2f2b8b93934fda 6f99560bca5c6d8d747c802f26058344eb179cec a5b2073d8f57ef0469b777f73d6c3f4a85cc17b4c2ed2a53aa3f1acb2273dbd5
GET /sb/au/2f/33/17/2f3317da28d2a6ed09610d2d267aa136/1648542458.html HTTP/1.1
Host: cdn.barscreative1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: text/html; charset=utf-8
server: nginx/1.21.6
last-modified: Tue, 29 Mar 2022 08:27:42 GMT
etag: W/"6242c2fe-ba1"
cache-control: max-age=3600
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
expires: Fri, 10 May 2024 19:42:17 GMT
x-proxy-cache: HIT
X-Firefox-Spdy: h2
|
|
| unseenreport.com/pxf.gif?uuid=f29918b1-072d-4ac3-979b-45347dc11738&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=36352469ba20ff8ade54795907dd51e5&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 | 192.243.61.227 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=f29918b1-072d-4ac3-979b-45347dc11738&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=36352469ba20ff8ade54795907dd51e5&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=f29918b1-072d-4ac3-979b-45347dc11738&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=36352469ba20ff8ade54795907dd51e5&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=18 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2a81adfe6d9e5ce0803a11534d18c4b8
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.creative-bars1.com/sb/chat/mob/ssp/1/img/close.png | 188.114.97.1 | 200 OK | 6.0 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/chat/mob/ssp/1/img/close.png IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typePNG image data, 522 x 391, 8-bit/color RGBA, non-interlaced Hashc489ce2c491a22ee37a55e26a92dfd73 2fa588ab09e94dd902e5bd24b48f98ad1949c9d6 1eed147c7d5de6291c25fbc5274830c12d5549262fb144271576d4e15966e5bd
GET /sb/chat/mob/ssp/1/img/close.png HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: image/png
content-length: 5982
last-modified: Mon, 21 Feb 2022 08:25:06 GMT
etag: "62134c62-175e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 864233
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Veizi532MEbNFhlWVwWJABjqUGy%2B9i%2F25Uu8AY35JvwF6mJpwc54KP5KPFpIRfnfhaUSrnSEDEpbxUg%2BeuIue1yPSY7RAOiiMOQ5ZpCooi6vkz9Teoh5yYOK%2BqjJIrhAbuvYmDFluLm8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c117ba89556cc-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.cloudimagesb.com/si/52/3a/8c/523a8ce104cfc3373cd17ab1c0e5131b/1701651901.png | 45.133.44.10 | 200 OK | 14 kB |
URL GET HTTP/2cdn.cloudimagesb.com/si/52/3a/8c/523a8ce104cfc3373cd17ab1c0e5131b/1701651901.png IP45.133.44.10:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectcdn.cloudimagesb.com FingerprintC6:F3:21:F0:21:7D:7E:96:0F:E8:46:7A:5E:C5:3F:D1:52:B0:67:B0 ValidityFri, 22 Mar 2024 03:01:35 GMT - Thu, 20 Jun 2024 03:01:34 GMT
File typePNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced Hash962ac416cce3fad636d4904386c8d3d4 811166fceb971353dc6a9ea3a153367f20b47592 ec6c8e1c030499a846897265d0c1f66dedc6ece17c1ea6006b700faf37e73555
GET /si/52/3a/8c/523a8ce104cfc3373cd17ab1c0e5131b/1701651901.png HTTP/1.1
Host: cdn.cloudimagesb.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: image/png
content-length: 14496
server: nginx/1.21.6
last-modified: Mon, 04 Dec 2023 01:05:10 GMT
etag: "656d25c6-38a0"
expires: Sun, 12 May 2024 18:42:17 GMT
cache-control: max-age=172800
x-proxy-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fanimate.css&l=79313&fd=409 | 192.243.61.227 | 200 OK | 0 B |
URL GET HTTP/1.1sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fanimate.css&l=79313&fd=409 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fanimate.css&l=79313&fd=409 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fstyle.css&l=4617&fd=436 | 192.243.61.227 | 200 OK | 0 B |
URL GET HTTP/1.1sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fstyle.css&l=4617&fd=436 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fcss%2Fstyle.css&l=4617&fd=436 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fjs%2Fscript.js&l=382&fd=322 | 192.243.61.227 | 200 OK | 0 B |
URL GET HTTP/1.1sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fjs%2Fscript.js&l=382&fd=322 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2Fsb%2Fchat%2Fmob%2Fssp%2F1%2Fjs%2Fscript.js&l=382&fd=322 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:18 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| sprangsugar.com/pixel/sbs?c=1 | 172.240.127.234 | 200 OK | 0 B |
URL GET HTTP/1.1sprangsugar.com/pixel/sbs?c=1 IP172.240.127.234:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbs?c=1 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:18 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| sprangsugar.com/impr.gif?sid=H4sIAAAAAAAC%2F1RST2tc1Rs%2Bd5LdD36gdFcLs3BRwUzunf%2BTisUYI8HY1KaiOzn%2F7uR0zr3ncs69cydZSLAgdTf4CW6eSRqsRdqtYJFJwUVA6LjKwmz8BhW6lhkHR9%2FFed%2F3PM%2BB5zzv%2B%2FVRdkmqyOjFxsfmQGlNVxsVv3z98yC4Ud5WcTYoD9rNL5r1G2XbX%2Bs0K%2F5b5Q8l75nVqh%2F4fuAH5U1lZWgGq1MQKnncCSodv1KvVoJGHQP7395lHhz1IPqX5HUoMVl%2B7l2B4mPE0ZMN6XqpSd7%2BIMo0TY1FX5x%2BGvdik8eIFmVoPYTx6ZwN415sPoOJT2ZyYfr%2FEJmaEO%2BXZ2Dx6VwkWP94ppNpyBhM%2FA95fwypx1B0DG7uQ4kXBOACt3YQRw9vGZvT%2Fb9ROkUnZPnVn1D5hCz%2FfgVx9MO6VoPyrtFZqkzsMAgLqMEYqjtGkp0hPShB5Wfg6VdQ4ley%2BmobcXS847SBEhdvhtVOJ2izYMVvVcVKnfLaSqfVYSv1Rq3eEjwIWrX2zCClxlDhGFoOQV0JmfOQKQ9Z6CFLPETiosyDIGj5glO%2F3eG8JlqSNYUf0FYY0MBvtpHx6R%2BGSJMhuB6C20Mk9hA9NYTNfobbK%2BDEMlw6Id4nX6IvCuSSIHcEOSXIFUGeEuT94kRoV3XFQ6FdxoJ5rs5zrRiZtHtET0zalTEBtUNYURwll%2BS1qYkeXXsHPXlRrjVrjWq92WG06odhmwrZqLc6jY7fEqIRyAacKqBcCdR5OFATsrZbIFET8sa1l2D0DE6fgasl0OwaaF6A7hU4iB%2FFVPWMrnATQZgCSbqMdN870pfk6myIWztPIPn5zT9qswC3BRJb4J56TtDVD0Z3TE6O75jckac7SaoidUCnA95NaSqXHn0k93NjxdaGG373Hp8C0%2FLxXenSbRoLFXcd%2BX5dCSHtprFckp%2B23GeS3c7c3npm4yzZvv3%2B5laUWOmcMvEYdLqrLy24mpD%2FX707293rP%2B5A2TFsViDKzsk8oMwYPDmESxb6nSGwesFhiYc8K0a2yhaXWhFouegpK%2BD%2B1bNFPbJ0%2Bpqq4sg9QNeWQNP7iKMCfVugrwtQPYTLlkZpYs9v%2FjaXwXRpxLQtHTNt9bczm6fHUzh1Ua75osVkKFtM1hv1UHLBGg3m85Czmmi3OVI3Cd%2B9981fAAAA%2F%2F8BAAD%2F%2FzUg302VBAAA | 192.243.61.227 | 200 OK | 7 B |
URL GET HTTP/1.1sprangsugar.com/impr.gif?sid=H4sIAAAAAAAC%2F1RST2tc1Rs%2Bd5LdD36gdFcLs3BRwUzunf%2BTisUYI8HY1KaiOzn%2F7uR0zr3ncs69cydZSLAgdTf4CW6eSRqsRdqtYJFJwUVA6LjKwmz8BhW6lhkHR9%2FFed%2F3PM%2BB5zzv%2B%2FVRdkmqyOjFxsfmQGlNVxsVv3z98yC4Ud5WcTYoD9rNL5r1G2XbX%2Bs0K%2F5b5Q8l75nVqh%2F4fuAH5U1lZWgGq1MQKnncCSodv1KvVoJGHQP7395lHhz1IPqX5HUoMVl%2B7l2B4mPE0ZMN6XqpSd7%2BIMo0TY1FX5x%2BGvdik8eIFmVoPYTx6ZwN415sPoOJT2ZyYfr%2FEJmaEO%2BXZ2Dx6VwkWP94ppNpyBhM%2FA95fwypx1B0DG7uQ4kXBOACt3YQRw9vGZvT%2Fb9ROkUnZPnVn1D5hCz%2FfgVx9MO6VoPyrtFZqkzsMAgLqMEYqjtGkp0hPShB5Wfg6VdQ4ley%2BmobcXS847SBEhdvhtVOJ2izYMVvVcVKnfLaSqfVYSv1Rq3eEjwIWrX2zCClxlDhGFoOQV0JmfOQKQ9Z6CFLPETiosyDIGj5glO%2F3eG8JlqSNYUf0FYY0MBvtpHx6R%2BGSJMhuB6C20Mk9hA9NYTNfobbK%2BDEMlw6Id4nX6IvCuSSIHcEOSXIFUGeEuT94kRoV3XFQ6FdxoJ5rs5zrRiZtHtET0zalTEBtUNYURwll%2BS1qYkeXXsHPXlRrjVrjWq92WG06odhmwrZqLc6jY7fEqIRyAacKqBcCdR5OFATsrZbIFET8sa1l2D0DE6fgasl0OwaaF6A7hU4iB%2FFVPWMrnATQZgCSbqMdN870pfk6myIWztPIPn5zT9qswC3BRJb4J56TtDVD0Z3TE6O75jckac7SaoidUCnA95NaSqXHn0k93NjxdaGG373Hp8C0%2FLxXenSbRoLFXcd%2BX5dCSHtprFckp%2B23GeS3c7c3npm4yzZvv3%2B5laUWOmcMvEYdLqrLy24mpD%2FX707293rP%2B5A2TFsViDKzsk8oMwYPDmESxb6nSGwesFhiYc8K0a2yhaXWhFouegpK%2BD%2B1bNFPbJ0%2Bpqq4sg9QNeWQNP7iKMCfVugrwtQPYTLlkZpYs9v%2FjaXwXRpxLQtHTNt9bczm6fHUzh1Ua75osVkKFtM1hv1UHLBGg3m85Czmmi3OVI3Cd%2B9981fAAAA%2F%2F8BAAD%2F%2FzUg302VBAAA IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RST2tc1Rs%2Bd5LdD36gdFcLs3BRwUzunf%2BTisUYI8HY1KaiOzn%2F7uR0zr3ncs69cydZSLAgdTf4CW6eSRqsRdqtYJFJwUVA6LjKwmz8BhW6lhkHR9%2FFed%2F3PM%2BB5zzv%2B%2FVRdkmqyOjFxsfmQGlNVxsVv3z98yC4Ud5WcTYoD9rNL5r1G2XbX%2Bs0K%2F5b5Q8l75nVqh%2F4fuAH5U1lZWgGq1MQKnncCSodv1KvVoJGHQP7395lHhz1IPqX5HUoMVl%2B7l2B4mPE0ZMN6XqpSd7%2BIMo0TY1FX5x%2BGvdik8eIFmVoPYTx6ZwN415sPoOJT2ZyYfr%2FEJmaEO%2BXZ2Dx6VwkWP94ppNpyBhM%2FA95fwypx1B0DG7uQ4kXBOACt3YQRw9vGZvT%2Fb9ROkUnZPnVn1D5hCz%2FfgVx9MO6VoPyrtFZqkzsMAgLqMEYqjtGkp0hPShB5Wfg6VdQ4ley%2BmobcXS847SBEhdvhtVOJ2izYMVvVcVKnfLaSqfVYSv1Rq3eEjwIWrX2zCClxlDhGFoOQV0JmfOQKQ9Z6CFLPETiosyDIGj5glO%2F3eG8JlqSNYUf0FYY0MBvtpHx6R%2BGSJMhuB6C20Mk9hA9NYTNfobbK%2BDEMlw6Id4nX6IvCuSSIHcEOSXIFUGeEuT94kRoV3XFQ6FdxoJ5rs5zrRiZtHtET0zalTEBtUNYURwll%2BS1qYkeXXsHPXlRrjVrjWq92WG06odhmwrZqLc6jY7fEqIRyAacKqBcCdR5OFATsrZbIFET8sa1l2D0DE6fgasl0OwaaF6A7hU4iB%2FFVPWMrnATQZgCSbqMdN870pfk6myIWztPIPn5zT9qswC3BRJb4J56TtDVD0Z3TE6O75jckac7SaoidUCnA95NaSqXHn0k93NjxdaGG373Hp8C0%2FLxXenSbRoLFXcd%2BX5dCSHtprFckp%2B23GeS3c7c3npm4yzZvv3%2B5laUWOmcMvEYdLqrLy24mpD%2FX707293rP%2B5A2TFsViDKzsk8oMwYPDmESxb6nSGwesFhiYc8K0a2yhaXWhFouegpK%2BD%2B1bNFPbJ0%2Bpqq4sg9QNeWQNP7iKMCfVugrwtQPYTLlkZpYs9v%2FjaXwXRpxLQtHTNt9bczm6fHUzh1Ua75osVkKFtM1hv1UHLBGg3m85Czmmi3OVI3Cd%2B9981fAAAA%2F%2F8BAAD%2F%2FzUg302VBAAA HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:18 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2bd7b9a8940faa10bee6d7c9fba380a0
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| cdn.creative-bars1.com/sb/chat/mob/ssp/1/js/jquery.min.js | 188.114.97.1 | 200 OK | 32 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/chat/mob/ssp/1/js/jquery.min.js IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeJavaScript source, ASCII text, with very long lines (65451) Hash561acb3e541133bbdd2c0c19f8ee35a1 ffd1353cf3f77d25f801c84d8208613eb0d3d548 9fde6da568db31801e29243a903bf24f342256b41e3c01e7d018ff7c566ce7fc
GET /sb/chat/mob/ssp/1/js/jquery.min.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: application/javascript
last-modified: Mon, 21 Feb 2022 08:25:09 GMT
etag: W/"62134c65-15d94"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 872681
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L6HR0BmujmIK29p2E75BCED%2BUmgfeeStKM6zvr6I4wGPOLgIjRQq0ORQ1hSEJ0SanahZFi7VpT4AuN0coOi%2F%2FpyAaGf0JRE2cRzV0Oez1dlUwnDl1Txbi5SM0tU5O5mQyP30nY8nHN8M"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c117bb8ba56cc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 IP216.58.207.227:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15860, version 1.0 Hashe9f5aaf547f165386cd313b995dddd8e acdef5603c2387b0e5bffd744b679a24a8bc1968 f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 09 May 2024 01:55:00 GMT
expires: Fri, 09 May 2025 01:55:00 GMT
cache-control: public, max-age=31536000
age: 146838
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0 Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 May 2024 09:28:37 GMT
expires: Sun, 04 May 2025 09:28:37 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 551621
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/chat/mob/ssp/1/css/style.css | 188.114.97.1 | 200 OK | 6.2 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/chat/mob/ssp/1/css/style.css IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typegzip compressed data, from Unix Hash08406c4066ae483190aba642482b9df6 8db42463ab2b2e290c00ea2743fe5e60fd8d89cc 93279d170a9509ca62dd5f75acb8499035abb35bcb15af95734facaf75b0f784
GET /sb/chat/mob/ssp/1/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: text/css
last-modified: Mon, 21 Feb 2022 08:25:04 GMT
etag: W/"62134c60-1209"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YtZysgbLnie5QUCOgd%2BOxn3duNlUJmuaeBF0e5ymLrHhB0chhBzNf2wXG9j7trPNy6rz59%2FnXI7rk5edja7RXC5hjWzbNpmhUlC2d4Rr8iOgX7cbeJNXakROdHUhh9r4%2B5980U8JU4kC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c117b482f56cc-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/chat/mob/ssp/1/js/script.js | 188.114.97.1 | 200 OK | 5.8 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/chat/mob/ssp/1/js/script.js IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
Hash4f5f05ab032dd8fc0db448fcf51a35e2 78f94f93fdb792d95ea3ac293ac1b8e3bc13d609 7fd8e9c0e5ca0c7123954a109fa8b7e8368c7e1262880925e2ac7b8c877a9e38
GET /sb/chat/mob/ssp/1/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:18 GMT
content-type: application/javascript
last-modified: Mon, 21 Feb 2022 08:25:08 GMT
etag: W/"62134c64-17e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fvtmb8uFe6jlv%2BIAVkbS2M0V3LAc8W0zohpgykuRRCB7G90rJqryH85HljS%2BRQvgzwrEEuVuPM%2BArXPw4Rb%2BCzR%2B6npgLTKRMjENy8rGDmWnnEVZwAJdGqR38GxmZmyrDw7VLq3jyGbm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c117c9a0c56cc-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F2f%2F33%2F17%2F2f3317da28d2a6ed09610d2d267aa136%2F1648542458.html&l=2977&fd=168 | 192.243.61.227 | 200 OK | 0 B |
URL GET HTTP/1.1sprangsugar.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F2f%2F33%2F17%2F2f3317da28d2a6ed09610d2d267aa136%2F1648542458.html&l=2977&fd=168 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerLet's Encrypt Subjectsprangsugar.com FingerprintA8:FF:DF:D3:ED:3D:E8:4B:33:C8:93:D3:94:CA:8E:28:5D:39:26:C1 ValidityMon, 06 May 2024 08:08:05 GMT - Sun, 04 Aug 2024 08:08:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.barscreative1.com%2Fsb%2Fau%2F2f%2F33%2F17%2F2f3317da28d2a6ed09610d2d267aa136%2F1648542458.html&l=2977&fd=168 HTTP/1.1
Host: sprangsugar.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Cookie: u_pl=23149116; uid_id2=f29918b1-072d-4ac3-979b-45347dc11738:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 10 May 2024 18:42:17 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| suggestqueries.google.com/complete/search?jsonp=autoRelated&hl=en&client=firefox&q= | 142.250.74.142 | 200 OK | 20 B |
URL GET HTTP/2suggestqueries.google.com/complete/search?jsonp=autoRelated&hl=en&client=firefox&q= IP142.250.74.142:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subject*.google.com Fingerprint7C:B7:E1:97:03:6E:82:B6:52:F8:EC:C6:C6:50:D9:DD:80:47:E6:A0 ValidityTue, 16 Apr 2024 03:18:53 GMT - Tue, 09 Jul 2024 03:18:52 GMT
File typeASCII text, with no line terminators Hasha1b72ded50d7e2b047cd0d3966b148ab 8ff9743451774724c183efa801b999ecce23821a 4d9063bb918234965c25e4a0844d20c1cb01dae120c181c92f39a33b869be23f
GET /complete/search?jsonp=autoRelated&hl=en&client=firefox&q= HTTP/1.1
Host: suggestqueries.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:16 GMT
pragma: no-cache
expires: -1
cache-control: no-cache, must-revalidate
content-type: text/javascript; charset=UTF-8
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-eZHJ6hCuCzIqrH2BKPqFDA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/fff
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/fff"}]}
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: gws
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| nathanielportoryxj0m02ml.pages.dev/ | 188.114.96.1 | 200 OK | 17 kB |
URL User Request GET HTTP/2nathanielportoryxj0m02ml.pages.dev/ IP188.114.96.1:443
CertificateIssuerGoogle Trust Services LLC Subjectnathanielportoryxj0m02ml.pages.dev Fingerprint25:91:36:83:61:0C:20:24:E8:3E:D0:FC:B2:DB:ED:47:A2:0D:19:E0 ValidityThu, 09 May 2024 17:01:09 GMT - Wed, 07 Aug 2024 17:01:08 GMT
File typeHTML document, ASCII text, with very long lines (7816) Hashf4c42abfb43117dd647f43156eb09263 57606b17775ecd3f86275230e2b449141b00c14b 8451c614a60eee67183a4884c3c89a10a5630c62ad574e5dd2a80c5cbfa3eba0
GET / HTTP/1.1
Host: nathanielportoryxj0m02ml.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:13 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"bb76cfdb7c678fab90a4be8a8dd8624c"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=myAzWa7moYzNIfenQ%2Bb2OrAnV04zvH%2BukHFhNjklWqVDvHKr4VjPY6Mv%2Fjw0VCOj51ldzEdQs8GIz21KEZrUWB9Tr%2FbBYHd9vWvNNNihxHN061KDx7HkTqFWqqbkmUpBbGL5lEDqQB%2BT2JKk8HTVje6jWcpg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c115df98b5688-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap | 142.250.74.74 | 200 OK | 7.0 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap IP142.250.74.74:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79 ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT
File typeASCII text, with very long lines (7193), with no line terminators Hash16b49a99486594c0b42d9bd7821deb2c 2fb46e5e86d6b37d4497cc04bfd89b3cb33a276a 3f3540952441e06ef81189cf63d46bac242804e386779dbb0cdd78ed10025c21
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 10 May 2024 18:42:17 GMT
date: Fri, 10 May 2024 18:42:17 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com/sb/chat/mob/ssp/1/css/animate.css | 188.114.97.1 | 200 OK | 79 kB |
URL GET HTTP/2cdn.creative-bars1.com/sb/chat/mob/ssp/1/css/animate.css IP188.114.97.1:443
Requested byhttps://nathanielportoryxj0m02ml.pages.dev/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
Hashfc638645a938f69e69360c75335ffd1a 143132fb8361c3ad0acf88cb70bf0b07c0ecc2d4 7ef76aab275d0221c68602d18f81b4285b280756f0f71d535ed8b5b889bc2f90
GET /sb/chat/mob/ssp/1/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nathanielportoryxj0m02ml.pages.dev/
Origin: https://nathanielportoryxj0m02ml.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 18:42:17 GMT
content-type: text/css
last-modified: Mon, 21 Feb 2022 08:25:04 GMT
etag: W/"62134c60-135d1"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
content-encoding: gzip
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sm0vEUj4wGw88IwTo%2BPsm9m7710uXmoqwX0Bgcf6egs5ShQVd9q8VkYa8lSnCUQ2uODBTS53Q1j6jSQ%2FLvHjsU9k6FT8Fm46qErCAyqHjQBVffe7u4VgLKuO8AL9SQkZLjok56lPT51Y"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 881c117b382756cc-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|