Report - aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea

Report Overview

Submitted URL
aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
IP
185.155.184.55
ASN
#5398 AS5398 SA
Submitted
2024-05-08 13:16:36
Access
public
Website Title
Apple iPhone 15 Pro
Final URL
aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
60

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-05-08	543 B	10 kB	216.58.207.227
jsontdsexit2.com	unknown	2022-05-16	2022-05-16	2024-05-07	465 B	575 B	136.243.216.235
aebpzl3.hellsixfirm.live	unknown	unknown	No data	No data	16 kB	469 kB	185.155.186.25
cdn.jsdelivr.net	439	2012-05-16	2012-09-30	2024-05-07	451 B	25 kB	104.18.186.31
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-05-08	439 B	32 kB	142.250.74.170

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed
2024-05-08	medium	hellsixfirm.live	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea	653 B	2024-05-08	2024-05-08
Pretty URL aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea IP 185.155.186.25 ASN #203639 Teknology SA Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-08 15:16:45 Last Seen2024-05-08 15:16:45 Times Seen1 Hash 9c48a503d7873cb0c545c4dfe643ebca 3f944c512c9348f79132cf1ff921056a8b40fc79 98100d1a7247da8ece64b0871768507251ddf9c376835a2381feb2927d7bb1d7 Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_3.js	17 kB	2024-02-25	2024-05-18
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_3.js IP 185.155.186.25 ASN #203639 Teknology SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-25 06:53:39 Last Seen2024-05-18 05:34:10 Times Seen116 Hash a050517d2e76dc353ab4591805bc7e43 a5b1a19c84c5f91dc0bb9beba2b6339269cb3980 05bb3b4c00a768232100b296f15b2087314183a9c4bf1819322b999550348b55 Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/icon.js	3.4 kB	2024-02-25	2024-05-18
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/icon.js IP 185.155.184.55 ASN #5398 AS5398 SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-25 06:53:39 Last Seen2024-05-18 05:34:10 Times Seen118 Hash bb6b0303bdf4d00f569ea2779560743a f7ad4dbde8c72b2513d1876621113ab9e1b1905e 76258946ee92a601aba0b605b921ab01168534b0987caf446dbbe4c3d3d25fba Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/u.js	24 kB	2024-02-25	2024-05-20
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/u.js IP 185.155.184.55 ASN #5398 AS5398 SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-25 16:07:16 Last Seen2024-05-20 00:23:47 Times Seen1275 Hash 89ed4b592ab506a6fca18e95657dfc4f 179998ad5741d669e75521fb943850a808917924 4ef3a6a1fd10bcf96549fd9a09bde836daea3343523644d1830367edc1f9031b Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/all/ab/dk/2.js	4.4 kB	2024-05-08	2024-05-08
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/all/ab/dk/2.js IP 185.155.184.55 ASN #5398 AS5398 SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-08 15:16:45 Last Seen2024-05-08 15:16:45 Times Seen2 Hash b43e9128eeea870f78f3db8cdc83f965 65d2be89c48ccdf89eaff85e6b0d21d090a46c9c 7f828f77dd91bed4223bbdc4ee681b2370869dd5f73e708b3257db5dcd48a81e Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_1.js	33 kB	2024-02-25	2024-05-18
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_1.js IP 185.155.186.25 ASN #203639 Teknology SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-25 06:53:39 Last Seen2024-05-18 05:34:10 Times Seen114 Hash de4af01a50db5454dbc0376dbd439af3 bb026b70a9701a80a580668d7d241c545a06d60d 8cfa2e960c0bf98660286437e4dceaae75c8a094760f6bdb9f088888f1567dbc Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-05-20
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 142.250.74.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-05-20 00:23:31 Times Seen145661 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js	79 kB	2023-03-07	2024-05-19
Pretty URL cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js IP 104.18.186.31 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:59 Last Seen2024-05-19 15:39:58 Times Seen15787 Hash a454220fc07088bf1fdd19313b6bfd50 265a733cb7fbc481fd2510a659a85ad55c93c895 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c Loading...

	aebpzl3.hellsixfirm.live/media/mainstream/sound.js	2.6 kB	2024-02-25	2024-05-18
Pretty URL aebpzl3.hellsixfirm.live/media/mainstream/sound.js IP 185.155.184.55 ASN #5398 AS5398 SA Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-25 06:53:39 Last Seen2024-05-18 05:34:10 Times Seen116 Hash 2832f0ff7ee2b8d871310202ffe7f5f4 9ff1c89b338faebfc1ebd10a72899c98af7165d0 cdd76972e0254fc58c898953ee47888137cf8a596c40d2fd9356a04cfe0ed76a Loading...

	aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea	159 B	2023-03-07	2024-05-18
Pretty URL aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea IP 185.155.186.25 ASN #203639 Teknology SA Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02:59 Last Seen2024-05-18 05:34:10 Times Seen3864 Hash 9a1faa7af595fcc37df537d166e60db8 685f77872d79510459078c4874685ab2fa7134ad b22f15ea1331a585549a4f1663ad5767da13c94abf77d4a4785158ddabfbd92e Loading...

HTTP Transactions (34)

URL IP Response Size

aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea

185.155.186.25

200 OK

22 kB

URL User Request GET HTTP/1.1
aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (841), with CRLF line terminators
Size
22 kB (21531 bytes)
Hash
849211c515b1354984e8d5aaced2cc8b
2082fd52af4b8b8bbf3441f7b8dd2627d4b47b8e
7e7ef9f346984f2e042b01b242d80b7f7738d6e06704c6e01be688fba2d5e157

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:08 GMT
Content-Type: text/html
Content-Length: 21531
Connection: keep-alive
cache-control: private

cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js

104.18.186.31

200 OK

24 kB

URL GET HTTP/2
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js
IP
104.18.186.31:443
ASN
#13335 CLOUDFLARENET

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerSectigo Limited
Subject*.jsdelivr.net
Fingerprint74:7A:63:DF:06:27:1E:52:8C:E8:0D:AD:1F:89:98:B5:EB:2D:49:EE
ValiditySat, 04 May 2024 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65297)
Size
24 kB (23541 bytes)
Hash
a454220fc07088bf1fdd19313b6bfd50
265a733cb7fbc481fd2510a659a85ad55c93c895
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c

HTTP Headers

GET /npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 08 May 2024 13:16:09 GMT
content-type: application/javascript; charset=utf-8
content-length: 23541
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-jsd-version: 4.3.1
x-jsd-version-type: version
etag: W/"1332b-JlpzPLf7xIH9JRCmWaha1VyTyJU"
content-encoding: br
x-served-by: cache-fra-etou8220110-FRA, cache-lga21961-LGA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 164957
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fsg3OfA3ejpnu2m1gS5KL9s1Uyw9xiLIay1ZkxKs3Dq4G3zwq7L4vM4scemkum%2B0PtEf%2FMRA1yGxaXHdn1RuefjYS%2FJyddWvYyNnC%2FAIwCSUT2un%2Fw0T68xSD9Cj28IdLb8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8809b8fdce9cb511-OSL
X-Firefox-Spdy: h2

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_2.css

185.155.186.25

200 OK

8.0 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_2.css
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
assembler source, ASCII text
Size
8.0 kB (7969 bytes)
Hash
9a13f3506156bf7084aa380c75fda671
117ab6de499a40abbfe8b7c56a6f40d812f0e309
fe71a9aa3271dd1850f74bbd853f9a9faeda64350652141c2ff6eb4dd8187ad5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/1102_2.css HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/css
Content-Length: 7969
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "9a13f3506156bf7084aa380c75fda671"
Last-Modified: Sun, 11 Feb 2024 15:21:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD8444D0C01F04
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1707664865#782664523/gid:0/gname:root/mode:33188/mtime:1707664865#834664609/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-11T15:21:05.86Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_3.js

185.155.186.25

200 OK

17 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_3.js
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (17374), with no line terminators
Size
17 kB (17374 bytes)
Hash
a050517d2e76dc353ab4591805bc7e43
a5b1a19c84c5f91dc0bb9beba2b6339269cb3980
05bb3b4c00a768232100b296f15b2087314183a9c4bf1819322b999550348b55

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/1102_3.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 17374
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a050517d2e76dc353ab4591805bc7e43"
Last-Modified: Sat, 24 Feb 2024 21:14:34 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD8444D5B91BAE
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708806775#246688139/gid:0/gname:root/mode:33188/mtime:1708809274#415062829/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-24T21:14:34.441Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_1.js

185.155.186.25

200 OK

33 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102_1.js
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (32813), with no line terminators
Size
33 kB (32813 bytes)
Hash
de4af01a50db5454dbc0376dbd439af3
bb026b70a9701a80a580668d7d241c545a06d60d
8cfa2e960c0bf98660286437e4dceaae75c8a094760f6bdb9f088888f1567dbc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/1102_1.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 32813
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "de4af01a50db5454dbc0376dbd439af3"
Last-Modified: Sat, 24 Feb 2024 21:14:34 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD8444D76B8E0D
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708806774#834687386/gid:0/gname:root/mode:33188/mtime:1708809274#191062456/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-24T21:14:34.217Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/icon.js

185.155.184.55

200 OK

3.4 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/icon.js
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (3422), with no line terminators
Size
3.4 kB (3422 bytes)
Hash
bb6b0303bdf4d00f569ea2779560743a
f7ad4dbde8c72b2513d1876621113ab9e1b1905e
76258946ee92a601aba0b605b921ab01168534b0987caf446dbbe4c3d3d25fba

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/icon.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 3422
Connection: keep-alive
ETag: "bb6b0303bdf4d00f569ea2779560743a"
Last-Modified: Sat, 24 Feb 2024 21:15:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DBD7867FF
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708808462#625688214/gid:0/gname:root/mode:33279/mtime:1708809303#535111389/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-24T21:15:03.562Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/flag-icon/css/flag-icon.css

185.155.186.25

200 OK

40 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/flag-icon/css/flag-icon.css
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
ASCII text, with CRLF line terminators
Size
40 kB (39806 bytes)
Hash
b7a46a018dcd21a4828bae0b04ddcc6c
1d8418d6cc45e5c29e1aab008c18ea633e7730c4
299595fd56aa6a2fcfac34fcf780d33b61785ad96f19485e65a33ead8fd69cbc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/css
Content-Length: 39806
Connection: keep-alive
ETag: "b7a46a018dcd21a4828bae0b04ddcc6c"
Last-Modified: Tue, 21 Nov 2023 12:30:15 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD8444D6942896
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223446#151840557/gid:0/gname:root/mode:33279/mtime:1655387459#318598233/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:59.318598233Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/sound.js

185.155.184.55

200 OK

2.6 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/sound.js
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (2564), with no line terminators
Size
2.6 kB (2564 bytes)
Hash
2832f0ff7ee2b8d871310202ffe7f5f4
9ff1c89b338faebfc1ebd10a72899c98af7165d0
cdd76972e0254fc58c898953ee47888137cf8a596c40d2fd9356a04cfe0ed76a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/sound.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 2564
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "2832f0ff7ee2b8d871310202ffe7f5f4"
Last-Modified: Sat, 24 Feb 2024 21:15:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DC00E7707
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708808462#893688670/gid:0/gname:root/mode:33279/mtime:1708809303#719111694/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-24T21:15:03.744Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/dk/2.js

185.155.184.55

200 OK

4.4 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/dk/2.js
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (4372), with no line terminators
Size
4.4 kB (4372 bytes)
Hash
b43e9128eeea870f78f3db8cdc83f965
65d2be89c48ccdf89eaff85e6b0d21d090a46c9c
7f828f77dd91bed4223bbdc4ee681b2370869dd5f73e708b3257db5dcd48a81e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/dk/2.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 4372
Connection: keep-alive
ETag: "b43e9128eeea870f78f3db8cdc83f965"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD85D00F608452
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#83743238/gid:0/gname:root/mode:33279/mtime:1653412323#985052000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:03.985052Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102.css

185.155.184.55

200 OK

22 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/1102.css
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
ASCII text, with CRLF line terminators
Size
22 kB (21546 bytes)
Hash
a42af1908408284441961ee5fac7891e
9c4e5d6eea95a03464380779a7ab9764e163f3a9
36a93a8003ab142dc7446633cf75524283582968ce207f8b773be234c4ed5cf6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/1102.css HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/css
Content-Length: 21546
Connection: keep-alive
ETag: "a42af1908408284441961ee5fac7891e"
Last-Modified: Sun, 11 Feb 2024 15:21:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DBDA21B99
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1707664865#134663447/gid:0/gname:root/mode:33188/mtime:1707664865#214663580/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-11T15:21:05.24Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/u.js

185.155.184.55

200 OK

24 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/u.js
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JavaScript source, ASCII text, with very long lines (24389), with no line terminators
Size
24 kB (24389 bytes)
Hash
89ed4b592ab506a6fca18e95657dfc4f
179998ad5741d669e75521fb943850a808917924
4ef3a6a1fd10bcf96549fd9a09bde836daea3343523644d1830367edc1f9031b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/u.js HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: text/javascript
Content-Length: 24389
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "89ed4b592ab506a6fca18e95657dfc4f"
Last-Modified: Sun, 25 Feb 2024 11:59:29 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD857B84DE80DB
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708809189#0/gid:0/gname:root/mode:33188/mtime:1708862369#235249424/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-02-25T11:59:29.279Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

142.250.74.170

200 OK

31 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
142.250.74.170:443
ASN
#15169 GOOGLE

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
31 kB (31021 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 May 2024 02:27:35 GMT
expires: Sat, 03 May 2025 02:27:35 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 470914
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/l.png

185.155.186.25

200 OK

11 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/l.png
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 768 x 293, 8-bit colormap, non-interlaced
Size
11 kB (11314 bytes)
Hash
3abe055e63c17d1fd7a5598c1924503d
7cc8997b72cda7eb64db973fea07f7c5c3e362e5
65c6b55f035b9973169b8f66625697e50ec57d6ed7f228e345fd77bb7c5c159d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/l.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 11314
Connection: keep-alive
ETag: "3abe055e63c17d1fd7a5598c1924503d"
Last-Modified: Wed, 27 Mar 2024 19:21:39 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD8444DB9DD22A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1708806802#566737914/gid:0/gname:root/mode:33188/mtime:1711567299#623963859/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-03-27T19:21:39.652Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr2.jpg

185.155.184.55

200 OK

2.8 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr2.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
2.8 kB (2815 bytes)
Hash
9b63ccbd631923743813e838190cecbf
5c6dd930c81346616e9c641ff41b6f18344c7e76
4ca9130a03f6874bab37d2d52fd4546e3de34ccccbd83aa5b9cb6ed0f923d8b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 2815
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "9b63ccbd631923743813e838190cecbf"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DCCB57D7A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#505053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.505053Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/top_red.png

185.155.184.55

200 OK

4.6 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/top_red.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced
Size
4.6 kB (4560 bytes)
Hash
a660370feb6a1543c3c872a52f7bcfa7
b9478ed6228e8fb34a393013d474cde8dc400848
9d1eed749548dad4b80b2d7ce32052143bd38773685029d7b60cee82a31840b7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/top_red.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 4560
Connection: keep-alive
ETag: "a660370feb6a1543c3c872a52f7bcfa7"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DCEB9E28D
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#276024555/gid:0/gname:root/mode:33279/mtime:1653412335#773078000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:15.773078Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr3.jpg

185.155.184.55

200 OK

3.6 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr3.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
3.6 kB (3601 bytes)
Hash
c74a5befd416e24626972e88ed65526d
4e8c25553248600cf23c3d6bcec488d986a129f8
53bb570f4465306a78670ecbea911ba0362251d2dc825d9ea0cb5d1c70f413ac

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 3601
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "c74a5befd416e24626972e88ed65526d"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DD3223D6A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#581053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.581053Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/muti_iphone15pro.png

185.155.184.55

200 OK

67 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/muti_iphone15pro.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 500 x 348, 8-bit colormap, non-interlaced
Size
67 kB (67385 bytes)
Hash
8229ea0942259f04cdd0da6f78d2614f
fc6698d9a6d5222c0c1d74d88470bc5147476146
cd2cc8db964e150f72e78ad4b8cd588fcb6e079ebffb1d9dce48855d11b5a039

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/muti_iphone15pro.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 67385
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "8229ea0942259f04cdd0da6f78d2614f"
Last-Modified: Thu, 05 Oct 2023 16:44:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DC70E0402
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1696524241#591174715/gid:0/gname:root/mode:33188/mtime:1696524241#755175160/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2023-10-05T16:44:01.808Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/iphone13pro.png

185.155.184.55

200 OK

29 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/iphone13pro.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 400 x 440, 8-bit colormap, non-interlaced
Size
29 kB (29184 bytes)
Hash
158df589f4b3810904cf7452928327c4
a5f1b1a9e28b0bc8de84dffea5b2ff519967001d
2d2cf6cd24f8d429837b8119ef2829e6e209e985f2288d80ba248585468650cb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/iphone13pro.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 29184
Connection: keep-alive
ETag: "158df589f4b3810904cf7452928327c4"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD85D03C6DEAD7
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#275743670/gid:0/gname:root/mode:33279/mtime:1653412328#41061000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:08.041061Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr5.jpg

185.155.184.55

200 OK

3.0 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr5.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
3.0 kB (3043 bytes)
Hash
7f103bc91a8084cd154189b5ebb2cf86
375e58c42a8c409bbf111847a1f6798ba6c0d5f5
346139aaec984853288672896d297ded47ac7ee1cb77ca43b63e130952cdd946

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 3043
Connection: keep-alive
ETag: "7f103bc91a8084cd154189b5ebb2cf86"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DD11A4D6F
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#123743329/gid:0/gname:root/mode:33279/mtime:1653412324#705054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.705054Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr4.jpg

185.155.184.55

200 OK

4.3 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr4.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
4.3 kB (4307 bytes)
Hash
f96150cbbb80ac607b3f264141a7faef
9ed21cb4e5c552f29bc23db55684c945e7582071
f013c5f2d9aedd8072d4bf01749c7dfcbacb80a43d06aa579403adfd8fd21fd3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 4307
Connection: keep-alive
ETag: "f96150cbbb80ac607b3f264141a7faef"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DD1460A63
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#641054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.641054Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box-iphone15pro.png

185.155.186.25

200 OK

5.8 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box-iphone15pro.png
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 258 x 185, 8-bit colormap, non-interlaced
Size
5.8 kB (5789 bytes)
Hash
f32165874f658a8497f38d204ebb92de
7511015ad482edaa0f024b5c78a7307a5e2e7077
8a623f9360c9544015b526a887ef1d3aeb7daba217fc1567fd0610fdea744792

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box-iphone15pro.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 5789
Connection: keep-alive
ETag: "f32165874f658a8497f38d204ebb92de"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD8444E6F29298
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1696524240#11170449/gid:0/gname:root/mode:33188/mtime:1696524239#959170312/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2023-10-05T16:43:59.959170312Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box_open.png

185.155.184.55

200 OK

2.7 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box_open.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 258 x 185, 8-bit colormap, non-interlaced
Size
2.7 kB (2685 bytes)
Hash
99264bee31a1abde5d0035468e53bbfb
d1f25383b68c3769eb3bdb36783e85c112078054
8da9180789c861b8d0d67d2bca168dfcc6de98f6999ab47400c38397d122157f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box_open.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 2685
Connection: keep-alive
ETag: "99264bee31a1abde5d0035468e53bbfb"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DCEB8C4C9
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412322#933050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.93305Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr1.jpg

185.155.184.55

200 OK

2.9 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr1.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
2.9 kB (2939 bytes)
Hash
4c88ebf87b0cc26121497de03db7f64a
a1256a5cfcd62223172eb3633659caddff6cf005
28db5edb0fe5e61f42eb8a0d10250a317f3ac840e074ffa761cb953c330f2cf6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 2939
Connection: keep-alive
ETag: "4c88ebf87b0cc26121497de03db7f64a"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DCADBB5C1
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#385053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.385053Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr11.jpg

185.155.184.55

200 OK

3.2 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr11.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
3.2 kB (3157 bytes)
Hash
752f51c4c387c0ca7f4337acdeec15d6
7f9777f95aececfce6fa930181269cce30a4a059
227cec10c842ba3865d12ed22363f87ca5135b3ac2c72e5ab1a3169c4a2d569c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 3157
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "752f51c4c387c0ca7f4337acdeec15d6"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DD617E60A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#445053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.445053Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box_closed.png

185.155.184.55

200 OK

5.8 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/box_closed.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced
Size
5.8 kB (5836 bytes)
Hash
890d869db1b3d28af588be81685214f2
5375bd0c2c75a6e40168f5561eb4eca993d14505
ea2521add13deb769fb7abee364670a567e7a3dc7b3b4474b5f80510dc593212

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box_closed.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 5836
Connection: keep-alive
ETag: "890d869db1b3d28af588be81685214f2"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DD014E163
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#7743068/gid:0/gname:root/mode:33279/mtime:1653412322#873050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.87305Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/x1.png

185.155.186.25

200 OK

593 B

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/x1.png
IP
185.155.186.25:443
ASN
#203639 Teknology SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced
Size
593 B (593 bytes)
Hash
ee850988ed56cd6f2498cae7993a8753
965f9091ca3e7f21f5b8115347227aedc93c586e
0303153a716bc5000d737521c0f6eb517700a1856b8e22ba8c088ec8f06ed8ba

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/x1.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 593
Connection: keep-alive
ETag: "ee850988ed56cd6f2498cae7993a8753"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD8444E6FDF34C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#276024555/gid:0/gname:root/mode:33279/mtime:1653412336#881081000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:16.881081Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/like.png

185.155.184.55

200 OK

357 B

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/like.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 15 x 14, 8-bit colormap, non-interlaced
Size
357 B (357 bytes)
Hash
17586a0aeb3f7b2aa7fb15a9251fbcd4
6adffad1183c93bc0dc114c89c77365734ec0dd6
8bf8dc3a4b6f7e4fa2a6fa74495c212f37a301311980cbc758050993ed9c07e1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/like.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 357
Connection: keep-alive
ETag: "17586a0aeb3f7b2aa7fb15a9251fbcd4"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DCA263A59
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#375743896/gid:0/gname:root/mode:33279/mtime:1653412329#505064000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:09.505064Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr6.jpg

185.155.184.55

200 OK

2.8 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/fr6.jpg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3
Size
2.8 kB (2814 bytes)
Hash
f17d127dfcaa6f94929eedd080276df0
ec801473523b8eb44e123b5634081d2b57715ba6
0108e4d428f408f819f174ae8a5923b4010e80a14fc9872b018c12781e114403

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/jpeg
Content-Length: 2814
Connection: keep-alive
ETag: "f17d127dfcaa6f94929eedd080276df0"
Last-Modified: Tue, 21 Nov 2023 12:30:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DD2CA4D72
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223402#123743329/gid:0/gname:root/mode:33279/mtime:1653412324#765054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.765054Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/all/ab/iphone15pro.png

185.155.184.55

200 OK

112 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/all/ab/iphone15pro.png
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
PNG image data, 417 x 515, 8-bit colormap, non-interlaced
Size
112 kB (112193 bytes)
Hash
86c9f807fc66133969f63198ac0fe75d
037a01ff739ddadb3a24e964002330176c75c5d2
5cc828750e8d07a70bb34de95a298592868d1bb1eb9d8e61b025779f9f3ddf58

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/iphone15pro.png HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:09 GMT
Content-Type: image/png
Content-Length: 112193
Connection: keep-alive
ETag: "86c9f807fc66133969f63198ac0fe75d"
Last-Modified: Thu, 05 Oct 2023 16:44:00 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD846DC61FC3EB
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1696524240#663172204/gid:0/gname:root/mode:33188/mtime:1696524240#875172775/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2023-10-05T16:44:00.929Z
Expires: Thu, 08 May 2025 13:16:09 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

216.58.207.227

200 OK

9.1 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 9132, version 1.0
Size
9.1 kB (9132 bytes)
Hash
358d3070946a90b4960cd111154fdc12
a0ba0bf47a7f905f9aa1a3ce15a39cdac62466ee
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

HTTP Headers

GET /s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://aebpzl3.hellsixfirm.live
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9132
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 15:16:35 GMT
expires: Fri, 02 May 2025 15:16:35 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
content-type: font/woff2
age: 511175
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

jsontdsexit2.com/ExtService.svc/getextparams

136.243.216.235

200 OK

362 B

URL GET HTTP/2
jsontdsexit2.com/ExtService.svc/getextparams
IP
136.243.216.235:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjectjsontdsexit2.com
Fingerprint48:31:DD:61:15:18:42:C5:25:8C:3D:8D:29:32:35:54:12:C1:59:1C
ValidityTue, 19 Mar 2024 13:03:39 GMT - Mon, 17 Jun 2024 13:03:38 GMT

File type
JSON text data
Size
362 B (362 bytes)
Hash
21e8196f866ec2a46caf1e2458fce0da
b062c4e59373c46766b67d3ee5b7bc59e5084012
ef8a623b0cc989ff7db8fd733dbb7ecb0570b2ecb5304bca647fbd6653411125

HTTP Headers

GET /ExtService.svc/getextparams HTTP/1.1
Host: jsontdsexit2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://aebpzl3.hellsixfirm.live
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 13:16:10 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2

aebpzl3.hellsixfirm.live/media/mainstream/alert.mp3

185.155.184.55

200 OK

8.8 kB

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/alert.mp3
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural
Size
8.8 kB (8802 bytes)
Hash
6d2d3da2ea28ace816fa4a138829dc18
606e0ec3d7fb05c69f16233cfe1ff0a0ee760505
d79bc81189750262716692ade6cc4d6fb6c4fbc4aa01c2b9d0aa67e5788821fc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/alert.mp3 HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:10 GMT
Content-Type: audio/mpeg
Content-Length: 8802
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "6d2d3da2ea28ace816fa4a138829dc18"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 17CD846DDC43FA9B
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843338#351669788/gid:0/gname:root/mode:33279/mtime:1655387452#802583242/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.802583242Z
Expires: Thu, 08 May 2025 13:16:10 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/media/mainstream/flag-icon/flags/1x1/no.svg

185.155.184.55

200 OK

331 B

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/media/mainstream/flag-icon/flags/1x1/no.svg
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type
SVG Scalable Vector Graphics image
Size
331 B (331 bytes)
Hash
d748f0d9f64c0ca1a40a0f6ec6bbb746
a76adb95e9ea9a737c72e4640b8d49b9e28cbb38
bdfbd626e4e76d0dc506e10be7dd429e4c4da684986cbd45e5398f1e9e1f28cc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/flag-icon/flags/1x1/no.svg HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/media/mainstream/flag-icon/css/flag-icon.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Wed, 08 May 2024 13:16:10 GMT
Content-Type: image/svg+xml
Content-Length: 331
Connection: keep-alive
ETag: "d748f0d9f64c0ca1a40a0f6ec6bbb746"
Last-Modified: Tue, 21 Nov 2023 12:30:16 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 17CD85D2282AABC4
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1695223446#883842180/gid:0/gname:root/mode:33279/mtime:1655387477#774640726/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:51:17.774640726Z
Expires: Thu, 08 May 2025 13:16:10 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

aebpzl3.hellsixfirm.live/favicon.ico

185.155.184.55

204 No Content

0 B

URL GET HTTP/1.1
aebpzl3.hellsixfirm.live/favicon.ico
IP
185.155.184.55:443
ASN
#5398 AS5398 SA

Requested by
https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Certificate
IssuerLet's Encrypt
Subjecthellsixfirm.live
Fingerprint96:CD:98:B7:5D:54:18:F3:CA:4D:AB:59:93:73:1B:B4:44:FB:94:45
ValidityTue, 07 May 2024 19:39:24 GMT - Mon, 05 Aug 2024 19:39:23 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: aebpzl3.hellsixfirm.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://aebpzl3.hellsixfirm.live/qjelmxji/?f=1&fp=f8DJs8Y/rALdp/m0msFxYA==&o=pglk4z4&sid=t2~row0qc4ag3ffhi2degrrwjvc&u=3lzpbea
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Server: openresty
Date: Wed, 08 May 2024 13:16:10 GMT
Connection: keep-alive

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML