| topoffer.monster/offer/nintendo/target/YWRlbmlldG9saXNAYW50cm9uZW5nLmNvbQ== |  208.109.188.221 | | 1 B |
URL topoffer.monster/offer/nintendo/target/YWRlbmlldG9saXNAYW50cm9uZW5nLmNvbQ== IP208.109.188.221:0 ASN#398101 GO-DADDY-COM-LLC
File typevery short file (no magic) Hash68b329da9893e34099c7d8ad5cb9c940 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
GET /offer/nintendo/target/YWRlbmlldG9saXNAYW50cm9uZW5nLmNvbQ== HTTP/1.1
Host: topoffer.monster
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Sat, 04 May 2024 23:31:01 GMT
Server: Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/7.4.28 mod_perl/2.0.12 Perl/v5.34.1
X-Powered-By: PHP/7.4.28
Location: https://minurl.online/nintendo
Content-Length: 1
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| minurl.online/nintendo | 208.109.188.221 | | 0 B |
IP208.109.188.221:0 ASN#398101 GO-DADDY-COM-LLC
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /nintendo HTTP/1.1
Host: minurl.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Sat, 04 May 2024 23:31:02 GMT
Server: Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/7.4.28 mod_perl/2.0.12 Perl/v5.34.1
X-Powered-By: PHP/7.4.28
X-Robots-Tag: noindex
Location: https://redirecting8.eu/p/Ta9u/2hRZ/u4wu
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| mybestprizes.life/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649 |  185.155.184.32 | | 63 kB |
URL mybestprizes.life/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649 IP185.155.184.32:0
File typeHTML document, ASCII text, with very long lines (47858), with CRLF line terminators Hash01f8a37a8974fd3b48d164b9e2e61f0c c72b596709165d49cdbf9cbcbfe8eb9c08764f00 c64054ec1ab8441fe882927693155dc07ff6eef84fa011bf1d141d44d8794bf6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649 HTTP/1.1
Host: mybestprizes.life
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://redirecting8.eu/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 04 May 2024 23:31:03 GMT
Content-Type: text/html
Content-Length: 62695
Connection: keep-alive
set-cookie: sid=t2~rgcejsnrqgllw2on5vnfp3pb; path=/
sid=t2~rgcejsnrqgllw2on5vnfp3pb; path=/
p1=https://hellsixfirm.live/ljmmopkg/; path=/
s1=k77q00aovozx4c0a; path=/
cache-control: private, no-transform
|
|
| mybestprizes.life/favicon.ico | 185.155.184.32 | | 0 B |
URL mybestprizes.life/favicon.ico IP185.155.184.32:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: mybestprizes.life
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mybestprizes.life/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649
Cookie: sid=t2~rgcejsnrqgllw2on5vnfp3pb; p1=https://hellsixfirm.live/ljmmopkg/; s1=k77q00aovozx4c0a
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx
Date: Sat, 04 May 2024 23:31:03 GMT
Connection: keep-alive
Cache-Control: no-transform
|
|
| ykewdck.hellsixfirm.live/ljmmopkg/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649&f=1&sid=t2~rgcejsnrqgllw2on5vnfp3pb&fp=cQn4l2RzJsSWE8fZg6CHzA%3D%3D | 185.155.184.55 | | 1.5 kB |
URL ykewdck.hellsixfirm.live/ljmmopkg/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649&f=1&sid=t2~rgcejsnrqgllw2on5vnfp3pb&fp=cQn4l2RzJsSWE8fZg6CHzA%3D%3D IP185.155.184.55:0
File typeHTML document, Unicode text, UTF-8 text, with very long lines (562), with CRLF line terminators Hashed78c3695059b0058d69d52bb7f0d5e6 a3d197748fb93e48f803870a27f316984e8999cd 435b47e251da10b3d673f27ae582de6dbe0251b773acf89398b1e29e654bb67d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ljmmopkg/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649&f=1&sid=t2~rgcejsnrqgllw2on5vnfp3pb&fp=cQn4l2RzJsSWE8fZg6CHzA%3D%3D HTTP/1.1
Host: ykewdck.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mybestprizes.life/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: openresty
Date: Sat, 04 May 2024 23:31:04 GMT
Content-Type: text/html
Content-Length: 1475
Connection: keep-alive
cache-control: private
|
|
| ykewdck.hellsixfirm.live/web/?sid=t2~rgcejsnrqgllw2on5vnfp3pb | 185.155.184.55 | | 277 B |
URL ykewdck.hellsixfirm.live/web/?sid=t2~rgcejsnrqgllw2on5vnfp3pb IP185.155.184.55:0
File typeHTML document, ASCII text, with CRLF line terminators Hashae3828bfd05fc955431a2259c11a051d e46dfb589dc8e043ab0c872eaf2576792c9c95e9 da53d8ee3345060522eac004c3d926cfc796a5a278a775278f87f009127731a1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /web/?sid=t2~rgcejsnrqgllw2on5vnfp3pb HTTP/1.1
Host: ykewdck.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykewdck.hellsixfirm.live/ljmmopkg/?u=kcdweky&o=cawpazh&cid=mlClick-1EiMGCoz&t=1028649&f=1&sid=t2~rgcejsnrqgllw2on5vnfp3pb&fp=cQn4l2RzJsSWE8fZg6CHzA%3D%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: openresty
Date: Sat, 04 May 2024 23:31:04 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 277
Connection: keep-alive
location: https://take.bestdealfor.buzz/?utm_medium=328f04fbc911d0ef90a27bee3b65bc74311fdc8b&utm_campaign=newmob&cid=b049f4e9-1894-4967-9211-8282505e7928&np=1
referrer-policy: no-referrer
|
|
| mediaservingoc.com/click.php?key=glg0el5milh3xjhb2jhu&subid=M7365291089231609857&partner_id=1314&pid=1314-24e31f9z&campaign_id=9626e6&browser=Firefox&device=Mozilla+Firefox&app_name=unknown&geo=NO&carrier=NO+WiFi&pcid=9626e6_1314-24e31f9z&pg=1314-NO |  95.217.42.163 | 302 Found | 0 B |
URL User Request GET HTTP/1.1mediaservingoc.com/click.php?key=glg0el5milh3xjhb2jhu&subid=M7365291089231609857&partner_id=1314&pid=1314-24e31f9z&campaign_id=9626e6&browser=Firefox&device=Mozilla+Firefox&app_name=unknown&geo=NO&carrier=NO+WiFi&pcid=9626e6_1314-24e31f9z&pg=1314-NO IP95.217.42.163:443 ASN#24940 Hetzner Online GmbH
CertificateIssuerLet's Encrypt Subjectmediaservingoc.com Fingerprint5F:3A:2A:6B:6A:18:7A:54:45:E7:19:86:E9:B2:FD:20:A2:53:EC:C9 ValiditySun, 21 Apr 2024 19:41:20 GMT - Sat, 20 Jul 2024 19:41:19 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click.php?key=glg0el5milh3xjhb2jhu&subid=M7365291089231609857&partner_id=1314&pid=1314-24e31f9z&campaign_id=9626e6&browser=Firefox&device=Mozilla+Firefox&app_name=unknown&geo=NO&carrier=NO+WiFi&pcid=9626e6_1314-24e31f9z&pg=1314-NO HTTP/1.1
Host: mediaservingoc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.26.0
Date: Sat, 04 May 2024 23:31:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: uclick=whwfa0; expires=Sun, 05-May-2024 23:31:05 GMT; Max-Age=86400; path=/; secure; SameSite=none
uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970; expires=Sun, 05-May-2024 23:31:05 GMT; Max-Age=86400; path=/; secure; SameSite=none
Location: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Strict-Transport-Security: max-age=31536000
|
|
| accuvisitor.com/3p/script.js |  51.91.68.47 | 200 OK | 2.0 kB |
URL GET HTTP/3accuvisitor.com/3p/script.js IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typeassembler source, ASCII text Hash8e8ad12b42350341e870a648dbfa1363 6a5ce0d03d3d8b244a4671a824131b19cbade987 252b35641180eb6f5ef167a3abf6dcef81b012f3d902cc0f46bb009fcd6451b5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/script.js HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: application/javascript; charset=utf-8
content-length: 2029
last-modified: Tue, 06 Feb 2024 10:52:54 GMT
etag: "65c20f86-7ed"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| accuvisitor.com/3p/style.css | 51.91.68.47 | 200 OK | 3.8 kB |
URL GET HTTP/3accuvisitor.com/3p/style.css IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
Hash4fab41811a8c6b717a86f86ab4de0105 06a085af05ca6879b83eac1498eead0ceddaadac 8cc56e01ec04772b51e8d8a3f8e0cb740a44a501c992a37b10515001cef94d4c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/style.css HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: text/css
content-length: 3774
last-modified: Fri, 02 Feb 2024 21:21:55 GMT
etag: "65bd5cf3-ebe"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| accuvisitor.com/3p/images/logo.png | 51.91.68.47 | 200 OK | 3.2 kB |
URL GET HTTP/3accuvisitor.com/3p/images/logo.png IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typePNG image data, 256 x 256, 8-bit colormap, non-interlaced Hash15a34b8fc618b2d90712f47874c211cc d1d998d74f30c2b5344de2f9f3f3ef4ac2fe03bb 3be024377b052ad72a32aa5de6eabbddf6fd4168d4579cc865c872d8e57fca36
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/images/logo.png HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: image/png
content-length: 3210
last-modified: Sun, 04 Feb 2024 19:21:22 GMT
etag: "65bfe3b2-c8a"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| accuvisitor.com/3p/images/check.png | 51.91.68.47 | 200 OK | 2.6 kB |
URL GET HTTP/3accuvisitor.com/3p/images/check.png IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typePNG image data, 256 x 256, 8-bit colormap, non-interlaced Hashc0879fd8363b5549b2ed0cec9b042b3b abeba0b0e5727a368e6bc963aecad9da8ec6f341 7879caae870090c87c28a02d608dd25d1988b6887c30f5ea99a3777964d905f5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/images/check.png HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: image/png
content-length: 2649
last-modified: Sun, 04 Feb 2024 19:21:22 GMT
etag: "65bfe3b2-a59"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| accuvisitor.com/3p/images/arrow.png | 51.91.68.47 | 200 OK | 2.9 kB |
URL GET HTTP/3accuvisitor.com/3p/images/arrow.png IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typePNG image data, 256 x 256, 8-bit colormap, non-interlaced Hashd190208ba37115f53c9a9057a130fcf3 5019f7d77731be18d40c89b746a247af4eb91853 25da48f054c6205c8c98783dcf2ca52813c0448180f5313fd17c95604d2ab901
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/images/arrow.png HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: image/png
content-length: 2938
last-modified: Sun, 04 Feb 2024 19:21:22 GMT
etag: "65bfe3b2-b7a"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| code.jquery.com/jquery-3.7.1.min.js | 151.101.194.137 | 200 OK | 30 kB |
URL GET HTTP/2code.jquery.com/jquery-3.7.1.min.js IP151.101.194.137:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash2c872dbe60f4ba70fb85356113d8b35e ee48592d1fff952fcf06ce0b666ed4785493afdc fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
GET /jquery-3.7.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-155ed"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 04 May 2024 23:31:05 GMT
age: 723261
x-served-by: cache-lga21978-LGA, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 5, 65667
x-timer: S1714865466.712646,VS0,VE0
vary: Accept-Encoding
content-length: 30336
X-Firefox-Spdy: h2
|
|
| wurfl.io/wurfl.js |  13.50.181.252 | 200 OK | 1.5 kB |
IP13.50.181.252:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerAmazon Subjectwurfl.io Fingerprint84:98:DD:3B:AF:04:6D:BB:FE:28:6C:10:1A:EF:71:B5:3C:48:38:97 ValidityWed, 23 Aug 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (3512) Hash4e56ee18d87f62dc6297b5d332d1b081 63b4003113f47f2602ac99e828ebf7d615dac68f 2bf5cac174101bde02ebd7664e6dac3f41c3206a3aee299ca2153f4e96d5fd9e
GET /wurfl.js HTTP/1.1
Host: wurfl.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ch: Sec-Ch-Ua, Sec-Ch-Ua-Arch, Sec-Ch-Ua-Bitness, Sec-Ch-Ua-Full-Version, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Mobile, Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version
Cache-Control: no-cache
Content-Encoding: br
Content-Type: application/javascript
Cross-Origin-Embedder-Policy: cross-origin
Cross-Origin-Opener-Policy: cross-origin
Cross-Origin-Resource-Policy: cross-origin
Date: Sat, 04 May 2024 23:31:05 GMT
Vary: accept-encoding, user-agent, sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version
Content-Length: 1488
Connection: keep-alive
|
|
| accuvisitor.com/3p/images/bg.png | 51.91.68.47 | 200 OK | 56 kB |
URL GET HTTP/3accuvisitor.com/3p/images/bg.png IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typePNG image data, 3500 x 3500, 4-bit colormap, non-interlaced Hash1d3c98099c0b3e2cda9c3ca2cd6a1a89 2bf1561dcfef7eba77215690758f45a8148718df 45dc96c114f10246160edc4407b8a4b517b1b27a43e56aedea256906c1c567c7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/images/bg.png HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: image/png
content-length: 55530
last-modified: Sun, 04 Feb 2024 19:21:22 GMT
etag: "65bfe3b2-d8ea"
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
accept-ranges: bytes
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 IP216.58.207.227:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15860, version 1.0 Hashe9f5aaf547f165386cd313b995dddd8e acdef5603c2387b0e5bffd744b679a24a8bc1968 f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://accuvisitor.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 01:55:00 GMT
expires: Fri, 02 May 2025 01:55:00 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 250566
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| get.geojs.io/v1/ip/country.js |  104.26.1.100 | 200 OK | 16 kB |
URL GET HTTP/2get.geojs.io/v1/ip/country.js IP104.26.1.100:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectgeojs.io FingerprintB4:9E:CC:F3:6D:DD:E3:68:A0:4A:B0:10:ED:5E:C2:60:0E:41:FE:36 ValidityMon, 11 Mar 2024 03:28:55 GMT - Sun, 09 Jun 2024 03:28:54 GMT
Hashbc6ee8470cd86e343324428608688d37 f1674eb6cd18dceb2bc3151e021d6cc97e7b1d9d 70f6e168492577b5f0ca28a9e982219df1aba2b134a49ab227033d6ff9f0beff
GET /v1/ip/country.js HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 04 May 2024 23:31:05 GMT
content-type: application/javascript; charset=utf-8
x-request-id: c7696c24989d294120156282d78779f0-AMS
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-geojs-location: AMS
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vxqNkei8vA94Fmw6uYIxkuuDDQW%2FUnGuuXr3NCkkGLN1XuQnWGsNfigkk27NfKJa3iBJpJLy%2FoDlFhIPmHQfMPLeoXJJrizYy%2BUe9vXMAn3mA8reXkC3qRRrZSlZ0w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87ec48489def56b4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 IP216.58.207.227:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15920, version 1.0 Hash3a44e06eb954b96aa043227f3534189d 23cef6993ddb2b2979e8e7647fc3763694e2ba7d b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
GET /s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://accuvisitor.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15920
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 02:03:54 GMT
expires: Fri, 02 May 2025 02:03:54 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:45 GMT
content-type: font/woff2
age: 250032
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accuvisitor.com/favicon.ico | 51.91.68.47 | 404 Not Found | 153 B |
URL GET HTTP/3accuvisitor.com/favicon.ico IP51.91.68.47:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typeHTML document, ASCII text, with no line terminators Hash6b0b81c864261cf3a7340fccfaf803ff f20f1f9b60e76821f868af83941dce31641ea54c f0f033de8e5147740811165be4c48fb96fb4bd1c249840ccc22735875fe0f753
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: text/html; charset=utf-8
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
content-encoding: gzip
|
|
| fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap | 142.250.74.74 | 200 OK | 14 kB |
URL GET HTTP/2fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap IP142.250.74.74:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79 ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT
Hash9c12b57a25710853b762d48b28545b5c 57a79d40792f42232b317bd9529c98efa29fc315 35ae53cd6f0cde71e622f6e54dc576bb82ffab56c9e41b1298f932eebf963eb9
GET /css2?family=Roboto:wght@100;300;400;500;700;900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://accuvisitor.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Sat, 04 May 2024 23:31:05 GMT
date: Sat, 04 May 2024 23:31:05 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
Requested byhttps://accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0 Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://accuvisitor.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 May 2024 09:28:37 GMT
expires: Sun, 04 May 2025 09:28:37 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 50549
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 | 51.91.68.47 | 200 OK | 3.4 kB |
URL User Request GET HTTP/2accuvisitor.com/3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 IP51.91.68.47:443
CertificateIssuerLet's Encrypt Subjectaccuvisitor.com Fingerprint61:56:5E:0C:3B:C2:AF:84:9F:43:1F:8E:61:24:4C:59:4B:06:44:49 ValidityTue, 02 Apr 2024 06:05:48 GMT - Mon, 01 Jul 2024 06:05:47 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (3592), with no line terminators Hash4b6f69b9b7c0cf3b7fe50f8ffc00c2c1 05b884c09d9ba836c24b4d22fce5ee06725a4aba 46cfa59380b361594d6378c617d28c9411ca6b6c1e225c3317bc1cd1ff0eee69
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /3p/?country=Norway&device_name=Desktop&domain=mediaservingoc.com&uclick=whwfa0&uclickhash=whwfa0-whwfa0-ir0-0-523y-ik3y-ikbl-709970 HTTP/1.1
Host: accuvisitor.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.25.3
date: Sat, 04 May 2024 23:31:05 GMT
content-type: text/html; charset=UTF-8
accept-ch: DPR, Width, Viewport-Width, Device-Memory, RTT, Downlink, ECT, Save-Data, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme, Sec-CH-Prefers-Reduced-Motion, Sec-CH-Prefers-Reduced-Data
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400
content-encoding: gzip
X-Firefox-Spdy: h2
|
|