Report - randmmineenisnosnnoif.pages.dev/robots.txt

Report Overview

Submitted URL
randmmineenisnosnnoif.pages.dev/robots.txt
IP
172.66.44.146
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-05 02:19:59
Access
public
Website Title
WEBDE Login
Final URL
randmmineenisnosnnoif.pages.dev/robots.txt
Tags
suspicious
urlquery detections
Suspicious - Suspicious Javascript code

Detections

urlquery
3
Network Intrusion Detection
0
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-05-04	446 B	34 kB	142.250.74.42
img.ui-portal.de	21604	unknown	2012-07-10	2024-05-04	1.1 kB	37 kB	2.18.172.165
api.ipify.org	3267	2014-01-05	2014-10-06	2024-05-04	504 B	267 B	104.26.13.205
randmmineenisnosnnoif.pages.dev	unknown	2020-09-02	2024-03-06	2024-03-21	2.8 kB	115 kB	172.66.44.146
ipapi.co	195030	2016-04-19	2017-01-31	2024-05-04	506 B	1.5 kB	172.67.69.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed
2024-05-05	medium	randmmineenisnosnnoif.pages.dev	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js	94 kB	2023-03-07	2024-05-18
Pretty URL ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js IP 142.250.74.42 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:13 Last Seen2024-05-18 18:45:35 Times Seen10805 Hash ddb84c1587287b2df08966081ef063bf 9eb9ac595e9b5544e2dc79fff7cd2d0b4b5ef71f 88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd Loading...

	randmmineenisnosnnoif.pages.dev/css/ua-parser.min.js	58 kB	2023-07-09	2024-05-06
Pretty URL randmmineenisnosnnoif.pages.dev/css/ua-parser.min.js IP 172.66.44.146 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-07-09 14:44:41 Last Seen2024-05-06 19:43:50 Times Seen8 Hash 5c3371b763857a1e6169fcf4eff33c85 4ccd6c1417a74e57691e3b7284054563f566a9cd df0cf8ca2fa2151b6d9c9f02e27c5b4a190a0e2f2b536875a7e472bce43fe36b Loading...

	randmmineenisnosnnoif.pages.dev/css/tgfiles.js	561 B	2024-05-05	2024-05-06
Pretty URL randmmineenisnosnnoif.pages.dev/css/tgfiles.js IP 172.66.44.146 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-05 04:20:00 Last Seen2024-05-06 19:43:50 Times Seen3 Hash 54a65d623ef6e029a6f9902b8c8e31dc 6f8aeb7aee1f4d74821d57c8ad353657832e5b67 7917192ca42030e585ed8cbcb733ebe0b8b8b1452f589aff3861aa01a8fe7b3f Loading...

	randmmineenisnosnnoif.pages.dev/css/neat.js	4.3 kB	2024-05-05	2024-05-06
Pretty URL randmmineenisnosnnoif.pages.dev/css/neat.js IP 172.66.44.146 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-05 04:20:00 Last Seen2024-05-06 19:43:50 Times Seen4 Hash 6afd9fa14d6cb0e198fa0f52c58ff04b d5406016d0d18df293b8e8e8dc419166e24484de 79cf9c0a0d78ca63f4e4ca9072c1bad13c8f3a7427945c649bcb3f706b10a603 Loading...

HTTP Transactions (11)

URL IP Response Size

ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js

142.250.74.42

200 OK

33 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
IP
142.250.74.42:443
ASN
#15169 GOOGLE

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (32769)
Size
33 kB (33333 bytes)
Hash
ddb84c1587287b2df08966081ef063bf
9eb9ac595e9b5544e2dc79fff7cd2d0b4b5ef71f
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

HTTP Headers

GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 33333
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 02:47:11 GMT
expires: Fri, 02 May 2025 02:47:11 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 257544
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-light.woff

2.18.172.165

200 OK

18 kB

URL GET HTTP/2
img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-light.woff
IP
2.18.172.165:443
ASN
#16625 AKAMAI-AS

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerDigiCert Inc
Subjectimg.ui-portal.de
Fingerprint08:99:FE:75:41:6F:09:D0:44:0F:99:57:49:77:38:72:97:18:8C:03
ValidityMon, 08 Apr 2024 00:00:00 GMT - Mon, 07 Apr 2025 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 18080, version 1.0
Size
18 kB (18080 bytes)
Hash
7d3616c7d04a9ae474875e42c4bc0496
4d0137dd6f1e5325eb3ba3e7bc4d577e68c75d46
7676e0d97793004054c4ec3e7cbd2d98c52fabc90479b7e3d5cfbb62f4e7a5af

HTTP Headers

GET /ci/webde/global/fonts/web.de-sans/web.de-sans-light.woff HTTP/1.1
Host: img.ui-portal.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://randmmineenisnosnnoif.pages.dev/
Origin: https://randmmineenisnosnnoif.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache
last-modified: Tue, 30 Jun 2015 08:59:54 GMT
etag: "46a0-519b86e043680-gzip"
x-robots-tag: noindex
access-control-allow-origin: *
content-type: font/woff
vary: Accept-Encoding
cache-control: public, max-age=543656
date: Sun, 05 May 2024 02:19:35 GMT
content-length: 18080
X-Firefox-Spdy: h2

img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-medium.woff

2.18.172.165

200 OK

18 kB

URL GET HTTP/2
img.ui-portal.de/ci/webde/global/fonts/web.de-sans/web.de-sans-medium.woff
IP
2.18.172.165:443
ASN
#16625 AKAMAI-AS

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerDigiCert Inc
Subjectimg.ui-portal.de
Fingerprint08:99:FE:75:41:6F:09:D0:44:0F:99:57:49:77:38:72:97:18:8C:03
ValidityMon, 08 Apr 2024 00:00:00 GMT - Mon, 07 Apr 2025 23:59:59 GMT

File type
Web Open Font Format, TrueType, length 18052, version 1.0
Size
18 kB (18052 bytes)
Hash
99eafbdc5f638d2fec6e869e5005f8f9
9f8f73605e41dc0eef8b5f5a46d3906716a7b3a5
01e773facc13e915276219573795dcf3f2a0fe00fca0841af95b21769872ff48

HTTP Headers

GET /ci/webde/global/fonts/web.de-sans/web.de-sans-medium.woff HTTP/1.1
Host: img.ui-portal.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Referer: https://randmmineenisnosnnoif.pages.dev/
Origin: https://randmmineenisnosnnoif.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: Apache
last-modified: Tue, 30 Jun 2015 08:59:54 GMT
etag: "4684-519b86e043680-gzip"
x-robots-tag: noindex
access-control-allow-origin: *
content-type: font/woff
vary: Accept-Encoding
cache-control: public, max-age=543707
date: Sun, 05 May 2024 02:19:35 GMT
content-length: 18052
X-Firefox-Spdy: h2

api.ipify.org/?format=json

104.26.13.205

200 OK

21 B

URL GET HTTP/2
api.ipify.org/?format=json
IP
104.26.13.205:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectipify.org
FingerprintC8:1A:05:47:C5:73:C6:CE:DF:1D:A6:DE:00:11:A9:9A:8C:DB:EF:A7
ValidityThu, 21 Mar 2024 19:56:02 GMT - Wed, 19 Jun 2024 19:56:01 GMT

File type
JSON text data
Size
21 B (21 bytes)
Hash
7d69c71af0f191e9a72db6153f8018d1
f67c5f2887bc05654b47f76e9621e53a4091aed1
5bac6e06cf0e1ad38c55f9f9d12122272bf4b8157877629fe68cd33fe2133c65

HTTP Headers

GET /?format=json HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/
Origin: https://randmmineenisnosnnoif.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 05 May 2024 02:19:35 GMT
content-type: application/json
content-length: 21
access-control-allow-origin: *
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 87ed3f1b080a5699-OSL
X-Firefox-Spdy: h2

randmmineenisnosnnoif.pages.dev/css/ua-parser.min.js

172.66.44.146

200 OK

20 kB

URL GET HTTP/3
randmmineenisnosnnoif.pages.dev/css/ua-parser.min.js
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (314), with CRLF line terminators
Size
20 kB (19982 bytes)
Hash
ca3cc054c864b363084231991e4da6e2
51c448161c05877374f88f5c838a01e9abdc45ec
764d6e025797264c4aa4046b939bb54770c0f1009eac4832502c38ccdf050df0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/ua-parser.min.js HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/robots.txt
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 05 May 2024 02:19:34 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"c76b32fe2f67ed0d8dfddc3b2a1312b4"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ckHbVRt4skYuazsSLYIgSxSbPYaDxqaW4ofsJldUkDRtyariLw%2Bahc08SV0VmjtYCdI7%2FgFdbSWiluzTl6hnOA%2FAk6cRm8IXxzSknrKyyilTCVgz%2BVc9vQaO2%2FuEwoxoPTIs%2BMeScQWraaKIH2FFArVF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f16d84356bb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

randmmineenisnosnnoif.pages.dev/favicon.ico

172.66.44.146

200 OK

12 kB

URL GET HTTP/3
randmmineenisnosnnoif.pages.dev/favicon.ico
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (3617), with CRLF line terminators
Size
12 kB (11493 bytes)
Hash
031c8821dca77e6af6f127ca9712a9f6
c4a98c81c32e8205c4a25ab18682af3be9b4a0ac
956997564b1425028806714c90287116cd40dbecf8b7b5ce3963269c4640b522

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/robots.txt
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 05 May 2024 02:19:35 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"216905f57fa59d29407ecbc6ac07a512"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtPWsdesf9uKGYs%2FHS9dLdmoYu%2F2pEftMNK%2FpX%2BiGj%2Bkcz8dSXbI2WQ%2B8gn34KuyCGxfvl6lsybjKHJe2Imor4vg1Iva3ghQ60AgiDf0t3HT9WJVPvdZWZ2hVWE%2FudKSXyT%2FxEf2K3ve1l2XqTQHAw5S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f1ae99b56bb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

randmmineenisnosnnoif.pages.dev/css/iwerr7.css

172.66.44.146

200 OK

61 kB

URL GET HTTP/3
randmmineenisnosnnoif.pages.dev/css/iwerr7.css
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type

Size
61 kB (61234 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/iwerr7.css HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/robots.txt
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sun, 05 May 2024 02:19:34 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"913361259c5be24a5dff7650edb8c128"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bZ7v0wgfFda6mn0C0X1%2FVFsx1F3m6JAZSn%2BxPqX5FULOtJrERz1cXEVOTgOuJMkuhKBOqH43na%2By7bEowLS84y1jld3XmYnNdaKmIwwNCsXn1vw0lpne89V89JWA6dY1kfDGyna2GQg96J%2BuZYOTwPWr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f16d84256bb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

randmmineenisnosnnoif.pages.dev/css/tgfiles.js

172.66.44.146

200 OK

561 B

URL GET HTTP/3
randmmineenisnosnnoif.pages.dev/css/tgfiles.js
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type
ASCII text, with very long lines (636), with no line terminators
Size
561 B (561 bytes)
Hash
72cb92df9a2346b07dd60333225fda92
b5ad61fc46ffc4a3c38405fb778d1ce4d347202b
f53b1f1dc5b3ddb95ae7471f173367ca30d5e0abdd61b55ec5cf11ac90d38d65

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/tgfiles.js HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/robots.txt
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sun, 05 May 2024 02:19:34 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"0986bbeb5334cef96d9f7436b32f734e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CuDmlfe%2BhcpvqNGAV%2BAPNp0ryWpRfVwQyQf%2Fy61K0tIEZULoSmPfIh2JD6M3t1hZTrpS9wM3sFg0NTmhYRCZRvCVFVHzWW8iVWCGIMpIYbWUdJmgcEUsiQdF8ExQuK%2BjVEkqUNz5%2F3llAHJUxzYno4XK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f16d84456bb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ipapi.co/91.90.42.154/json

172.67.69.226

200 OK

744 B

URL GET HTTP/2
ipapi.co/91.90.42.154/json
IP
172.67.69.226:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerLet's Encrypt
Subjectipapi.co
FingerprintF4:65:F9:9B:26:CD:26:53:C7:F0:24:4D:F3:3B:E2:8E:8F:8F:60:D7
ValiditySat, 09 Mar 2024 17:29:09 GMT - Fri, 07 Jun 2024 17:29:08 GMT

File type
ASCII text, with very long lines (870), with no line terminators
Size
744 B (744 bytes)
Hash
f55d46bc645189e127961c66c5efb9b4
6ae674e090a2e80a4d512a8848ab34d7c11b65bc
6cb703f7995717251d724238bca09c5dc99a14d99aafd1836fc59ada3d36101f

HTTP Headers

GET /91.90.42.154/json HTTP/1.1
Host: ipapi.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/
Origin: https://randmmineenisnosnnoif.pages.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 05 May 2024 02:19:36 GMT
content-type: application/json
allow: HEAD, GET, OPTIONS, POST, OPTIONS
x-frame-options: DENY
vary: Host, origin
access-control-allow-origin: https://randmmineenisnosnnoif.pages.dev
x-content-type-options: nosniff
referrer-policy: same-origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cNvGkuHH2OpHsNUOcTwdGGLytb51rP1YDnN7ogZoCvaKwQIWE0myfqgjysRBfNYSKkOKatnCYQbEro3ZPXiDjTA5vpnRWrUqrH7mtmaxraV%2F9mhCNuXF19i7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87ed3f1cbb27b4ed-OSL
content-encoding: br
X-Firefox-Spdy: h2

randmmineenisnosnnoif.pages.dev/robots.txt

172.66.44.146

200 OK

13 kB

URL User Request GET HTTP/2
randmmineenisnosnnoif.pages.dev/robots.txt
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type

Size
13 kB (12591 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /robots.txt HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 05 May 2024 02:19:34 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"216905f57fa59d29407ecbc6ac07a512"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ShOD2naT2taaSKGuiLZVvFWmB6UAIi6a8U6w7gslqGPxTanAYPafJoFRkYedQptwmTMDkRNB7uGMTqtxZJzslrK2%2Bx5k9o1vj9ca7iVfX02LccU%2FL3TSSA1%2FN1ryb6b59g4bI5YE5TgwgIafcMYyx0dC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f143d2156b1-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

randmmineenisnosnnoif.pages.dev/css/neat.js

172.66.44.146

200 OK

4.3 kB

URL GET HTTP/3
randmmineenisnosnnoif.pages.dev/css/neat.js
IP
172.66.44.146:443
ASN
#13335 CLOUDFLARENET

Requested by
https://randmmineenisnosnnoif.pages.dev/robots.txt
Certificate
IssuerGoogle Trust Services LLC
Subjectrandmmineenisnosnnoif.pages.dev
Fingerprint39:7D:2E:1B:80:99:39:C1:EB:EC:5E:D2:11:C6:34:F5:6E:56:C2:7F
ValiditySat, 04 May 2024 11:05:22 GMT - Fri, 02 Aug 2024 11:05:21 GMT

File type
JavaScript source, ASCII text, with very long lines (4645), with no line terminators
Size
4.3 kB (4315 bytes)
Hash
ebbc486f1e2e7f4513775072ba334668
9a5e24d8bcc2c8451ae9a42f049a31b8cbc407a6
e4cd7696516e5d4de7de5dfb338a561053d1f51419e9344e0aa0b5c679021cb3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /css/neat.js HTTP/1.1
Host: randmmineenisnosnnoif.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://randmmineenisnosnnoif.pages.dev/robots.txt
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sun, 05 May 2024 02:19:34 GMT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"ecce696794c11130c70e4e1f5d9c6e0b"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qIMqDOOpB%2BrGgt97wQWB1QXoJeDGuJpb%2Fatti3rV78ZCSN6aR85AIpEhVRtGoglrZZqDh0L%2F%2BT6gxlL%2FjaDeW%2BFg%2BPC0Z0m5kIx6NmGRIRCjEpocA2%2BL%2BvrB6v0CsgcPB3Ylh%2BlMWMzwTGWtVNNre4Nw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87ed3f16d84556bb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (11)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size