| go2cliks.net/cpa/12026/1400?subid1=2gvs8vecsSbEvZUXjeu7Mv |  84.16.252.20 | | 244 B |
URL go2cliks.net/cpa/12026/1400?subid1=2gvs8vecsSbEvZUXjeu7Mv IP84.16.252.20:0 ASN#28753 Leaseweb Deutschland GmbH
File typeHTML document, ASCII text Hash50810108b1f0834f29456fb54d504504 9796a0272542e83704d38857afa01f2df429d3d8 8a7953875310ec99bcd76e48fdf8055530e0b7b7998b8592d264e43ce6fce901
GET /cpa/12026/1400?subid1=2gvs8vecsSbEvZUXjeu7Mv HTTP/1.1
Host: go2cliks.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 10 May 2024 15:57:50 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 244
Connection: close
Content-Encoding: identity
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Fri, 10 May 2024 15:57:50 GMT
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: mobitck=1; expires=Fri, 10-May-2024 23:59:59 GMT; Max-Age=28929; path=/; HttpOnly
|
|
| go2cliks.net/go/12026/5 | 84.16.252.20 | | 321 B |
IP84.16.252.20:0 ASN#28753 Leaseweb Deutschland GmbH
File typeHTML document, ASCII text Hash78e7789f3cdfc12e2a9f22a382307893 0a187411a4da5838501e0d7c455abc69486f4781 15d91043c953321164fa8d680bb35b4714be7e2b2941fbc799aaa829ebb5193d
GET /go/12026/5 HTTP/1.1
Host: go2cliks.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: mobitck=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 10 May 2024 15:57:51 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 321
Connection: close
Content-Encoding: identity
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Fri, 10 May 2024 15:57:51 GMT
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: mobitck=2; expires=Fri, 10-May-2024 23:59:59 GMT; Max-Age=28928; path=/; HttpOnly
|
|
| shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 |  104.21.58.91 | 200 OK | 3.3 kB |
URL User Request GET HTTP/2shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 IP104.21.58.91:443
CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeHTML document, ASCII text, with very long lines (7872), with no line terminators Hashd27674b0e3a48472fcd6327ddc4ac32d a3ea4ee2beb6b24abb8720f261aff10e226179b7 7efd359ba5cb1dd442831c4f29c110f7abed8317281829e7bea2defdd8a4561d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: text/html
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1l5dQdS6hINFIQu%2BJqY5Cf0utQmADeqQOtgVGwhqzwS6x5o2XFB8rxOYMhPSKn%2BH9oYqVZNBEL9pT0w6zd%2Bjz81lZeqY6xMMp8MLyma27k7cicu1JCAnYfrpqYyo7WRRStUh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209b4ea656ba-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/js/_each-land-config.3299fec3.js | 104.21.58.91 | 200 OK | 21 kB |
URL GET HTTP/3shaudaunsoam.com/js/_each-land-config.3299fec3.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash0ba3468fb169d838d511e11b5b33eaef fb53785cd4dcc6e5cf0fcebfcafed46a3968cbe9 6de414b4180a6f11c4f5a9ba570d5e97ac8e596b1f9c1bb86872a11ecd416384
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/_each-land-config.3299fec3.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=72043
etag: W/"662b7651-1196b"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RXMgj4XgdSBA8smulp2I0g0bl4xE3dg1gMLVlAKLLyyPapgZTZS%2FlM2bi1gWS9Fu52uyL24L1ZbQlPqZMKVXOhj9xF3MQ93ZaX2Jpqv1%2FDfl59Dtri0RK7Mngv0RACycOUuu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfd57131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| arleavannya.com/sync-metrics |  139.45.197.248 | 200 OK | 17 B |
URL OPTIONS HTTP/2arleavannya.com/sync-metrics IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hash5b64e8b89092b2e3dfd448b10700627f 484b3032619fa1acd135d114565b0a5166281c22 f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 726
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: 784eec26cf7c8da62ebb17f0a9326a5e
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/pfe/current/micro.tag.min.js?z=6163354&sw=/sw/sw6163354.js&var=7296273&var_3=null&var_4=null&ymid=12026&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000 | 104.21.58.91 | 200 OK | 11 kB |
URL GET HTTP/3shaudaunsoam.com/pfe/current/micro.tag.min.js?z=6163354&sw=/sw/sw6163354.js&var=7296273&var_3=null&var_4=null&ymid=12026&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000 IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (27174), with no line terminators Hash75c26ccd65e96e912725399ff3ce66e9 d300939979d2048844dc5ac80c51ed8121126f4e c9db5c92934b273ad485c58710d6fbc2d580c2923a99bb456b18cb5e1465f5cf
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pfe/current/micro.tag.min.js?z=6163354&sw=/sw/sw6163354.js&var=7296273&var_3=null&var_4=null&ymid=12026&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000 HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
vary: Accept-Encoding
etag: W/"662b7651-6a26"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBe45Xzx5P4FtBkkKlR648GehMTeUDddXaBANN0XQgX4H9550buqdTqYvJRLOujAHpAKFo4TdHNzUScljEHP0iEOjbNvVYb5PVU2RAzOhrziBcQP7qXFVd92G3F1N%2F0d0%2Fu9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ebb127131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/SweepHeader.b279c2bf.js | 104.21.58.91 | 200 OK | 1.0 kB |
URL GET HTTP/3shaudaunsoam.com/js/SweepHeader.b279c2bf.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (1009), with no line terminators Hash0fe439de7df51eacd129903e89a15baa cd04958d3fa581e73b01c27ea41d97d5a430d75f b79bec35661387c45718f5592adf5634587c228d85d45c3b5139bac73214bdf9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/SweepHeader.b279c2bf.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-3f1"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1fYBURB6RqKulYD%2F5f4Mi1hUU18xlI9pgHCw4N8%2FDOxh2A%2Fo5A9mdnNE5SNbsAmNom6x8PbAuet1tbuaUKuMP2yWG2exu3%2F9CuwAy3WS%2FQ21c1CM4%2FQFW9sas1%2Bew2dvzJzF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb277131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| offpichuan.com/track?offer_id=3983&z=7296273&request_var=12026&variable2=136dlvs5g0082&oaid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji | 139.45.197.237 | 200 OK | 211 B |
URL GET HTTP/2offpichuan.com/track?offer_id=3983&z=7296273&request_var=12026&variable2=136dlvs5g0082&oaid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji IP139.45.197.237:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectoffpichuan.com Fingerprint8B:DE:51:B7:81:9E:EA:DE:73:A4:3D:67:F9:5E:6F:7B:F4:D6:77:5A ValidityMon, 15 Apr 2024 21:54:27 GMT - Sun, 14 Jul 2024 21:54:26 GMT
Hash8bb93619cff9e07220b3e0d4b05c9745 5323caf97cbba734adbd17e3920c81912c5049b1 566f1ae38bfa84bbe870f2b36d71df23b2e82eca4f9a6c4b17e6273269a5638f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /track?offer_id=3983&z=7296273&request_var=12026&variable2=136dlvs5g0082&oaid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji HTTP/1.1
Host: offpichuan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/json
content-length: 211
x-trace-id: 400b6743d06488c234fc5276b2f60e56
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| arleavannya.com/sync-do | 139.45.197.248 | 200 OK | 0 B |
IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /sync-do HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-length: 0
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/img/comments/person-sweep-1.webp | 104.21.58.91 | 200 OK | 862 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-1.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x52, Scaling: [none]x[none], YUV color, decoders should clamp Hash384118eb5e49870ad443d90051c692cb 35a73704dcf55b3232f2e9cfc333ff2ecfdcc19f 1ae21006f04f15e16a8057644615cdf8a8a9b39db706f53ba9a925327a6a1635
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-1.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 862
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-35e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FZfBuAy6bE3Lps6q1yIvSE9tN0hzGurJSdv1uEoei6j0tckWalEYAMFiBw3pA8wiCIjpyOVlupmjTSw32bSWUVNb6e1KdvBX3%2FX40DeOwvcl8RB1AAi1H62pDxntXj0BTcko"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a01d447131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-2.webp | 104.21.58.91 | 200 OK | 538 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-2.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hashe4d97f0d392aca4fa78b0928438d0168 55f713d8826a9a65e11fddf4c5fa4ea5939953b2 7058be64334990621fbc8cc06782aac5116c6e8a6d7700d892cb8b36f06c5866
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-2.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 538
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-21a"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ru6dqeo5oH3AXzYKGJJP4oVnckmsiC5gM%2BOG4CAtghy%2Bn7wVhScQkY8GwEMv%2FYLUT3x0bDmKQQX5cExqHySN3hZASasG58oe3cliAEN4WoPVAKBfKIjlkO4jo4EaRJMW5XT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a04d767131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-3.webp | 104.21.58.91 | 200 OK | 582 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-3.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash8347ebfbfa18beba17d356a3dbacb100 f1d66a05e07953cea27fe277e72a495a8e3de2e7 318e494a7bcf7cb28173e54feebeb44ba93b4c17a423c7036d2fcac40e4db6cd
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-3.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 582
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-246"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cqb7AE0RlJR7fwuaGn9IOEINqyFdsBFgjskQgO5GRgjnBqkHzka3PhJ4vNAATp8%2BPsKDLllU7JxDUXbTywZBwInY0tiDN%2Bf025f6k02h4kF7wxoT93Ej6zPbLyjlsmKcmDAt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a04d787131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-4.webp | 104.21.58.91 | 200 OK | 800 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-4.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hashb1c95558f71bd6614c52433c225b6a28 7c903c12b48199ac1e1b3c8846baf12693b97a28 8e5987af9fd886b03617f6e4980035a877697b9ccdeb9f002c41baa1d6ee8912
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-4.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 800
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-320"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2CF6csg%2FTbZCaNa8zUTrqzUO71HFaq%2BxHdxNfwGaLf5jZAlXrrEpnXsA%2Bn54o1kwIbK247120fPoA6ExR%2BOanwgDrrM38N0xDzusu5ObxMlemhMjXxAuM88dtTDr70U3ow%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d867131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-constants.js.49317f47.js | 104.21.58.91 | 200 OK | 818 B |
URL GET HTTP/3shaudaunsoam.com/js/v-constants.js.49317f47.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (600), with no line terminators Hash973e735a355fd5b10428c250e8fd7236 bd3fb14c90e2700400c69b15a84e317d52493bd9 16f1d5ca604ad59b9e5b484b1a0cf2d43eebda055ecee80ac847fbcc4437f0b2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-constants.js.49317f47.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-258"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gNshigxt3%2Fc75IrSvRGgEvShYoUcL6MOZxrqEaQBeTxUBwFQ%2FoEypZgbtWYP6rPVb2YoE5tRZKJhXo88VCnxYBTNf%2FYbKBG6BIYe%2BIHbKjQ77YhpiCmFiKVHN7XKi8gypj%2F1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209edb547131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-5.webp | 104.21.58.91 | 200 OK | 588 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-5.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash25e1107a0e365082ccd6093e0073f05c 7b0d3c741f2bbabbcac99f29bee8cf2f9eaa1841 935ec86b128c0bb7bfafc5915a46c0c3709c47b90509e26e4c994d8ef5587cf2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-5.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 588
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-24c"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fee7mRw%2FaZUc%2BPqH2z1KHblXBLFtzLaqzHJfl%2BOq6AKo8A3U6wa2c%2BFAutWYznG2t3sYUSM91phCPmJTAV0yGNzg8HrrhmMXRBM0B461EgrBf%2FtsS%2BslzvOU2P3UXInpSeox"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d8a7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-utilities.js.d1112fc4.js | 104.21.58.91 | 200 OK | 1.9 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-utilities.js.d1112fc4.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (2577), with no line terminators Hash18cb151303391373ec2138ce7f10bd7f c3d6fdc026a675d23ac14beebd3a46e3e72e9dc4 93cc28fc75a9cbc865ed918e1a8d139ecf52c3a7d9a2caef63ed7092f69ee142
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-utilities.js.d1112fc4.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-a11"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xcsDPpjmfl2TVYmxRUYV7dus9K8qpZQxuraXKQYFf8jxYKP8PeH7I%2BsUH30QuhFmao49ozVYe05UR50g%2F0piHoZD5Riao17qQB0N1SbB9Ox%2BVQd0IVQH4NdMkcdHSlCH3QVC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb327131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-8.webp | 104.21.58.91 | 200 OK | 696 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-8.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash6a6742fef0cd1bd74f6da94e9fb833e1 ccaae2ff48574bbb04072b2efc5864b9177017a5 96bf5ed5aa8149269a215cf19a17889c762b8cddb2fe36229849c8379c2d4aa6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-8.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 696
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-2b8"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDaRxnLIs3JeCEccCH7UGfpJEvQdZ5tOybIAQg1iZ8sj0ee%2BNKDJjH6umpf1twhzrMfqlwG6wWH0dZFPD0yEE3u5ru2k29ce0lt3taYGtH8gozNy0YY0EZfcjkleg9JN9tvm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d907131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-9.webp | 104.21.58.91 | 200 OK | 818 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-9.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hasha61b1f29004e5a54130bc57051a49c0d 7f60eef07e311b3598895343111d90282a002ea0 b3de11ad2ace70aa9786af4a9e65db774466fe25aca16e16dabdfa7ec76b0a53
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-9.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 818
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-332"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9AM3C3Fbi%2Ffg8OlpopR5tNlcVcWGcYKiCioD0zRviEmldMnSJ0u7xOprNLFeRPMimXHyzf03zSWrZOnrQVHiUNr8V2%2F9X8zfJHvesLBdWcPbF0UrItVMt5bASQVI4fpegMcX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d947131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-10.webp | 104.21.58.91 | 200 OK | 572 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-10.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash206819c13484a7a818f1e4499be3704e ada2f34308d6eaa0d004ed0c732e5a3aa7fda1db f4eed862cbcf8f9ce2bde63cf3e13e73ed3e58ac93ec4bb14301b248c4d58e1f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-10.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 572
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-23c"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SlMiK4B8kTJGQ%2F0U859Isa3ZSP1QWim7cjHaCi6GSJ6Nj9G27V8FZeHdMXWcJyHgyVKvJb1JbroLrnIh17PeX49NzLiAnGQU80q%2BrUaFmzJqwjLRfjX0DAR52XGJId3mt2Hz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a06d997131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-11.webp | 104.21.58.91 | 200 OK | 502 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-11.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash7ec874233fc75e1ec8df712b7ebbd7d2 cc219fb2b7e6057a8303283023dd1aa09a082455 9bb6b14a5a503d3c52bc6fc2e7c236a90e7971ceb41cb99e5245fcfc39ef328b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-11.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 502
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-1f6"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BobaE7T%2B%2FkpwDOxD0XP1YeDretyRDPZbznK0ODgBTBwphB227CY1kF6dEpjLlLz0FyzjZza1XCrBch9%2BrHgJDk7ki3kBeMJWuRCIX0FmX3O1BdxoWAmAWvo2M7%2FwWOeQ4WSt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a06d9a7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-12.webp | 104.21.58.91 | 200 OK | 668 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-12.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hashc57b8a772545ee6e05fedb58c143beb1 6cb5aef79f86275a725cfdd406c7038b24d80aa9 03389ef007f0fd3486a5c71848fd2b67cc05341cf449bcdd34a81a1d4048b090
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-12.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 668
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-29c"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KcpqPvpbyTOcD1UEjvOaCxAW9LRfERFuN2a46CQMQKr7Dl3NLCIw6zFSadBPQtm80ibr%2FMDanD%2FXZw8HSzRuwTc0PnDngBT82ElxgU2rgF9j45m8NKOIhwpwZ5QH71n5wycJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a06dac7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| arleavannya.com/sync-do | 139.45.197.248 | 200 OK | 175 B |
IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hasha7fbccd9aed97a405c912f014e54e33d d1f5a4e6a184f566d272fb282c7719dac8da4d38 27abda38a3b61986ba145f4fc9a02407cc4649fb26b3cec1a4bda41b7cba21c3
POST /sync-do HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 153
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/json; charset=utf-8
content-length: 175
x-trace-id: da2fce5fab8c0f31138c5c17b977e326
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/img/comments/person-sweep-14.webp | 104.21.58.91 | 200 OK | 626 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-14.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash7c494127025f1ec09a96c16bf0531a36 0c2f9302c41f99da9fb5eead2c364bdbdf435156 e6443a7cdcc5ee11ece88ce10824fd79851700e4bd3dc6259d1a816182b82e5b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-14.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 626
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-272"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HSAkHa9NYxwtaPlc2SeB%2BQC9XhVi7stv3MTT9XGTz97mF4xvd3GV8yiHyf7nRMo8FynFoB77n1quyZPqstgN1wdWgkpn3JZyOFCm25KZmf%2B0EzqF5we5eZT0a4PLo1OPE0F6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a08dd97131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-13.webp | 104.21.58.91 | 200 OK | 640 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-13.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hash8532ec97225298a9c3ae5e393f62e462 fc26fa010830045fa91a16ac9b8c89c45bb35232 9c45568c99b7782b240341ba6729ecacc59d41a8ced9b9846ca4ac51e50c5320
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-13.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 640
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-280"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n2UHmH2iQ0hO4Bor4jlVnsHcGNKLlZuLPOdpgIkpaWqimZZbc0h%2FA5bpqozLtgEXwVN%2BasGHjHxlIqAZ%2BY8wBf4mHCmS0Trxx0cR52YttWvo91mI%2FjgaLqrVLBvpkw0J9mLg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a08dd87131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| arleavannya.com/sync-metrics | 139.45.197.248 | 200 OK | 0 B |
URL OPTIONS HTTP/2arleavannya.com/sync-metrics IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-length: 0
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| ofklefkian.com/zone?&pub=0&zone_id=6163354&is_mobile=false&domain=shaudaunsoam.com&var=7296273&ymid=12026&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest | 139.45.197.251 | 200 OK | 0 B |
URL POST HTTP/2ofklefkian.com/zone?&pub=0&zone_id=6163354&is_mobile=false&domain=shaudaunsoam.com&var=7296273&ymid=12026&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest IP139.45.197.251:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectofklefkian.com Fingerprint04:A9:FE:8D:C9:B9:EE:6F:3A:C4:29:EA:19:AD:C3:1D:7D:3E:14:02 ValiditySun, 14 Apr 2024 05:38:05 GMT - Sat, 13 Jul 2024 05:38:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /zone?&pub=0&zone_id=6163354&is_mobile=false&domain=shaudaunsoam.com&var=7296273&ymid=12026&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest HTTP/1.1
Host: ofklefkian.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-length: 0
x-trace-id: 0ee02064b4802b1bc6f67877fdbfbb2d
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: null
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/js/SurveyContainer.e2959212.js | 104.21.58.91 | 200 OK | 15 kB |
URL GET HTTP/3shaudaunsoam.com/js/SurveyContainer.e2959212.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (57082), with no line terminators Hash0df7a0f05192a1af311ce45d48639a89 df29dce5914578a52af5f516ccd18d289d808951 4cde10689c1ef6c2f58585483fae6d656ccfa1d16cc282dcfbe6cb89700ae2dc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/SurveyContainer.e2959212.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=57085
etag: W/"662b7651-defd"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2GOyrgQE7yEBadtoOBymMGlpM3he%2BfguddRCxtgTMDWCFEuO%2BuW8SmpC5B0M%2BY0w6JqU8r2gUfYtAIZWrPWzezK3xoTHDEK8%2BPqrb9st7WiFmXJye%2BTRCqMsHnPFB4%2BL6N4c"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209edb587131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/pfe/current/stattag.js | 104.21.58.91 | 200 OK | 90 kB |
URL GET HTTP/3shaudaunsoam.com/pfe/current/stattag.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (19053), with no line terminators Hash3a74216e872211a9c770302bb7d4a63f 7e63556174a7d66eee407218e503ec0aae2c0f9e 03405209d89a927b81d53eb13968663069760776389c5400bb79d11bd9f78f78
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pfe/current/stattag.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-4a6d"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3kS6loSzj0mi0lnXHfKbzrqoUZyxeYxYCDykoh7hlfU0GljLw5tixC8BVSCNMo0j9079hh%2BXv9yNCTh4QW3mX%2FRIV1PBOlX6qbgxd97t4ZArV9jazYnoOHroEghVwXIc6KTB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a0de3b7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| arleavannya.com/sync-metrics | 139.45.197.248 | 200 OK | 17 B |
URL OPTIONS HTTP/2arleavannya.com/sync-metrics IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hash5b64e8b89092b2e3dfd448b10700627f 484b3032619fa1acd135d114565b0a5166281c22 f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 844
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: e8f96648d9a930fee05db467d082c8f9
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| arleavannya.com/sync-metrics | 139.45.197.248 | 200 OK | 17 B |
URL OPTIONS HTTP/2arleavannya.com/sync-metrics IP139.45.197.248:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectarleavannya.com Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47 ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT
Hash5b64e8b89092b2e3dfd448b10700627f 484b3032619fa1acd135d114565b0a5166281c22 f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 2639
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: ea7347d75838a7e8f92cdaf7cc97fc7b
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| datatechonert.com/log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=263fdcd7-b877-454b-9cf3-aaf2fdec8d7f |  37.48.68.71 | 200 OK | 12 B |
URL POST HTTP/1.1datatechonert.com/log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=263fdcd7-b877-454b-9cf3-aaf2fdec8d7f IP37.48.68.71:443 ASN#60781 LeaseWeb Netherlands B.V.
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerSectigo Limited Subjectdatatechonert.com Fingerprint3F:E1:50:2C:9F:FC:F9:37:03:E3:B6:34:00:06:89:69:01:E7:C3:27 ValiditySun, 10 Dec 2023 00:00:00 GMT - Mon, 23 Dec 2024 23:59:59 GMT
Hashadb4650bfc9d2a73d4dd69583b0ceb14 1ce399d6e936232aaf2192cd7903a279c5015f22 21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
POST /log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=263fdcd7-b877-454b-9cf3-aaf2fdec8d7f HTTP/1.1
Host: datatechonert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1469
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Fri, 10 May 2024 15:57:52 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://shaudaunsoam.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true
|
|
| shaudaunsoam.com/js/_rtc.f86a36d7.js | 104.21.58.91 | 200 OK | 12 kB |
URL GET HTTP/3shaudaunsoam.com/js/_rtc.f86a36d7.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (12222), with no line terminators Hash128d6eec0793a7e02c314d2f6245f260 c9f09311c3f229b770f38d0cc69b422430f1c748 bf1606ac64db254cc565a094e7162a96f31f7e48ddece56fc92c654559e5abb8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/_rtc.f86a36d7.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2fbe"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5aDfdk2xflNI98i%2BWPZe2BAqZdc8AAAzmF2sAb4lziTC9aAdcUqjbK4n92G4JWu1RYb%2BgIRpGMgKSq55P7LgbrqDu1S4HbWJjRseJhGVVsvgbrrc7Tm13JhYfYanGU%2FsRc8U"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfc17131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-react-dom.production.min.js.c3329619.js | 104.21.58.91 | 200 OK | 47 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-react-dom.production.min.js.c3329619.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashc53e5e3d8c5ca5f1c4edbce65426edfc 36cc2e7e0b893d82bf5f457c7a62374019d0f7aa ed83bf6bc001bd6f841c76b67aedfd3bc02cb28fb5537a1d55804f5ad0515e39
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-react-dom.production.min.js.c3329619.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=129359
etag: W/"662b7650-1f94f"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cTw91lLN7oVJaT9rTFkNYZ01Dq9MuNId9PCrxrv0%2FT6uTia1XmZiqzHuuIwhkYX3Wm3rsZZ6i9c%2BrxJYbTvEmK7YiZld8q8T8nuqHZ%2BS90CCQyT5eVt7g1WAkVJho2AH4%2BRH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cefd97131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-index.js.da9f7529.js | 104.21.58.91 | 200 OK | 14 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-index.js.da9f7529.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (40985), with no line terminators Hash47a5b821c80a532b5e989cf87d451283 c0f9e87128e1d7d634649fb3c7b6c08f714e79bc 2526538666fe9c7811b9afaf71794b4f8cb4f0751f62872e1a0d8c3a6c131f07
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-index.js.da9f7529.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=40988
etag: W/"662b7652-a01c"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2BBHp2rIAxMdt0y289CYfvnTbdaorJ2jKe8oqMITwiGWebovt2%2FH6kbdLc5ncv%2BqbBo%2Bz0fI9cWNuxBKQ5N1SjR%2Bof5UHWdVgR9RHWPVhHS4H1QYtetpEX3B2FGfoBnyLnRl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfc27131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| offpichuan.com/rotate?zz=4599387;4599749;4702124;5426181;5426173;5428099;5426182&var=7296273&ymid=12026&uid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji | 139.45.197.237 | 200 OK | 2.9 kB |
URL GET HTTP/2offpichuan.com/rotate?zz=4599387;4599749;4702124;5426181;5426173;5428099;5426182&var=7296273&ymid=12026&uid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji IP139.45.197.237:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectoffpichuan.com Fingerprint8B:DE:51:B7:81:9E:EA:DE:73:A4:3D:67:F9:5E:6F:7B:F4:D6:77:5A ValidityMon, 15 Apr 2024 21:54:27 GMT - Sun, 14 Jul 2024 21:54:26 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (2894), with no line terminators Hashc17668aa933cd01b4e090845a4a3c0ec b47c52cf2c2ad507bd7addc11bcd8e626efb81dd 5deec06fac032392b44a43bb21301f6ede2ae60991bff89ae6d99252fec3a00b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /rotate?zz=4599387;4599749;4702124;5426181;5426173;5428099;5426182&var=7296273&ymid=12026&uid=7uo8e8bqt4b7hmiiquoc3wre030ik0ji HTTP/1.1
Host: offpichuan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/javascript
x-trace-id: d9954231db6fbb51b3f12fd07947d3c6
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://shaudaunsoam.com
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
set-cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; expires=Sat, 10 May 2025 15:57:52 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/img/comments/person-sweep-7.webp | 104.21.58.91 | 200 OK | 610 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-7.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hasheb52e160b8ea5a1e0de8b2453f46d642 4d28311b4ca822a0a74e318c9d1f54def088b509 2e9c67781abf2cfbabb240bfd08ca836658063849f3303b85027203eec1d37c5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-7.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 610
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-262"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DWVbgGeiGbDlnkymr1dH8VZrBQXriePueYWE4LpADWpFbqP20AvrZcgb7lbSzgGLdq1Np625bYT28cQZVopKi5ETpAMz4qtrSdgoSThM2Yoz67laavq7qOp%2BxYSrx8VB9%2FRn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d8f7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| my.rtmark.net/gid.js?userId=7uo8e8bqt4b7hmiiquoc3wre030ik0ji | 139.45.195.8 | 200 OK | 65 B |
URL GET HTTP/2my.rtmark.net/gid.js?userId=7uo8e8bqt4b7hmiiquoc3wre030ik0ji IP139.45.195.8:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectrtmark.net FingerprintDB:C0:8B:64:1C:E3:2A:9C:B9:04:0D:F3:6F:5A:E0:35:F4:C7:75:CC ValiditySat, 02 Mar 2024 21:53:43 GMT - Fri, 31 May 2024 21:53:42 GMT
File typetroff or preprocessor input, ASCII text, with no line terminators Hash32a4881faf1214020697c967c681072e edc192a27ee6d419847d72a3638b4ec0a4286690 57d3d20f48cacd75a163620025c00035ba2a3736ab3a5e1dd077acaa2416e979
GET /gid.js?userId=7uo8e8bqt4b7hmiiquoc3wre030ik0ji HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shaudaunsoam.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://shaudaunsoam.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; expires=Sat, 10 May 2025 15:57:51 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| shaudaunsoam.com/js/s-checkSessionStorageAvailable.ts.e8412d91.js | 104.21.58.91 | 200 OK | 330 B |
URL GET HTTP/3shaudaunsoam.com/js/s-checkSessionStorageAvailable.ts.e8412d91.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (338), with no line terminators Hash6eb1ccbb769935debb74de9858287720 5302f94074f05eb22f05368dfe3464b85c89fb48 1e016cce8f09ded837e6e46c9e26d5dddccc19bbfa89c9dc583c04d85e2c7bb4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/s-checkSessionStorageAvailable.ts.e8412d91.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-14a"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tV1TQA%2FmiAL7NncdWqR9JaOV1uToX6bnD%2FgmaCgT7hSUBThxZBMPQAhNpGaOCws9YeqFtDKKx5isIpYQcgmmQadvDmaoHjVYJ1xF%2BScuxZ18VWc6m9TNC240W4tjV9XttwjH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfca7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-redux-toolkit.esm.js.fe3487ca.js | 104.21.58.91 | 200 OK | 11 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-redux-toolkit.esm.js.fe3487ca.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (11319), with no line terminators Hash5aa3676547abc9a38889c09e69ca968d d19ea919192e86f97c34c0a5959ad05c52299aec 21648e7ba668a077e403b6bd1a38f05d55d987737b959d57e3b3c53787107eb7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-redux-toolkit.esm.js.fe3487ca.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2c37"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sIAnpwmtlXpfsYQpQx9yf8I2NFl1mqAgFTp3qw2NHEl6OvalApmNyGNlRVzUIfRZ7VD3INylzYEaINSxy6pd17SfotM7VZC6FalAFSZKsRqWyfJ2%2BJgQu4Tm4GmRDljoaDN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfd37131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/css/sweeps-survey.f5ae42b0.css | 104.21.58.91 | 200 OK | 94 kB |
URL GET HTTP/3shaudaunsoam.com/css/sweeps-survey.f5ae42b0.css IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (65536), with no line terminators Hash895c99e8dc2cac2fe41b6e4623314c0e aa530776c5425e3f15a8ad66ee1bc43840172ac6 bb88f272fbb80a919f86655f6cffff6d8419f09b60e279c9727d904f16d73d9c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /css/sweeps-survey.f5ae42b0.css HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=93694
etag: W/"662b7650-16dfe"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EYhWEpAGd6hjUO%2BU4cBpROmlFRXs4Hoz8gPBk%2FUp%2FX1q3rpbkQAgD68nCAu812Z%2BhbLXFI1vtBvSF8rHviI5OSOfcJr6r0qxvtQxiNStMK9gLHj4vMly2VFCFuuu%2FfgEmdox"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ceff67131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/favicon.ico | 104.21.58.91 | 200 OK | 1.2 kB |
URL GET HTTP/3shaudaunsoam.com/favicon.ico IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hash668ba1a9fa1890ba16cb8adc28d3dad8 5e35223b2541265114eaf61b9da2556c812fea17 7746cf1b553433822522f2dc432f55fe64eee1f1cf823ef6adfde02e58e1d7e2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/x-icon
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-47e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rYVJGizpL22mwTbH7z0LiiGuPwtojwcGHQDdgmD%2F7C2KRcMMMDxzUDUvdhSRewNWgjvJVZh1%2Fcn%2FAO1IRj253dZANFsQprN8d8Yfj1GAQ3DzKgL2bPUa2qweTisqC4m9doLX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a3995b7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/css/SweepHeader.8e7220ee.css | 104.21.58.91 | 200 OK | 369 B |
URL GET HTTP/3shaudaunsoam.com/css/SweepHeader.8e7220ee.css IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (369), with no line terminators Hashb3e63dbf70b8e4ad7c5ec23726112e15 e083def5d026fb5bc171c3043f714fd5d859f82b be1433fba47a27551a04629ff55f1a1d944922016569342433d79f0200d8959d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /css/SweepHeader.8e7220ee.css HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=370
etag: W/"662b7650-172"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2BKRzqSZgexs5NZH52kV4L5z3TAhFr6%2BLjso4XG3mTYxseesY6QyyugHk9KN0fDk7Q2sp3er%2Bmi5A%2F0RTK%2BWtKv%2FAD0smerUMffBnmUn1zXGrpKxzppls9deo33%2BEK1PAh9d"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb217131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/comments/person-sweep-6.webp | 104.21.58.91 | 200 OK | 462 B |
URL GET HTTP/3shaudaunsoam.com/img/comments/person-sweep-6.webp IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeRIFF (little-endian) data, Web/P image, VP8 encoding, 50x50, Scaling: [none]x[none], YUV color, decoders should clamp Hashdfb961fdb848e75591268fde9c186902 2218e96a5c5081f5bef43fda74fd8f0cbb025003 4cf92de9b24fb1484bc1d97880c20589e113b9b1f065df1963e0648f3a38474d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/comments/person-sweep-6.webp HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/webp
content-length: 462
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-1ce"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XyVfr2kz%2F55s4g70kVgbmtRT6nJh096dRZ7QXQOhbbHj2SLBaDMVjFf1%2BTn0XzEY%2BgnLnomGnddOWqQWxiNuv8tivJsjMynrPvQM619Ss%2Bo8rDcmM%2FA%2BDuK8CKghGCePzvai"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a05d8d7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/config/dict/cookie-consent-1.json?v=10 | 104.21.58.91 | 200 OK | 6.8 kB |
URL GET HTTP/3shaudaunsoam.com/js/config/dict/cookie-consent-1.json?v=10 IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (6009), with no line terminators Hash4b2ff958e811a50d2f641818590b443d 6abae297812bb55fad869e953e7fdf7469cbe1ae 9c77a5f3d0028d9ba122ed15728ee7b144619431f8302503a19c5785ddaa06b8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/config/dict/cookie-consent-1.json?v=10 HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/json
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-1a65"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WGtitpm0rnZR0ZpcuDTlNQTZLciJfumeuUynTVsASBmdntG6m9CDYyTbA5tawXsD%2BsiAM6Kn23Rcxh%2BiTpIq7cyDc9cMNlnibj80j43FYhhjmisiPJvn9BLIgjRNuxL6tDgP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209de97d7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/img/sweep/tokens10k.png | 104.21.58.91 | 200 OK | 82 kB |
URL GET HTTP/3shaudaunsoam.com/img/sweep/tokens10k.png IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typePNG image data, 480 x 500, 8-bit colormap, non-interlaced Hash10337a4976db716ba3b8cad1f0f1f736 788015c74e561249cc5318fc178e564b68bce44d fef211dba7465da86e75019f78dcdf59af496394963b0bc6cc78b02286effe58
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /img/sweep/tokens10k.png HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: image/png
content-length: 82163
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-140f3"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3180
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NbA4cqq6LacxqgOfW4VqlIsTt0JTcsnf%2B%2F6AVaQUVLzJmvD55uthJcYf44Xu0wzXZxUaGtk2e2ZB%2FnI7WPV4XGWMIPui%2BSZTMQ%2BL6sxDlnwQS7Zy6CaepqZfLo4uhMelHldK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b20a13e9b7131-OSL
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-attributes-to-props.js.a2e7cd04.js | 104.21.58.91 | 200 OK | 702 B |
URL GET HTTP/3shaudaunsoam.com/js/v-attributes-to-props.js.a2e7cd04.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (718), with no line terminators Hash4f868b7a0330d32e1450766a54886355 4b5952301185e7b02e2cdcba80f4aea3de700c47 2435c4b396d0b35fca9f618a201479cdcd64e84d43a386eec071a4082d7a781f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-attributes-to-props.js.a2e7cd04.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2be"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ReE76Bcxaeew%2FacQ%2FboM%2FRSYfl43UQz5GPbwAKH9WiiPdRzK47IiGt9sZ0Jk77xlLUT2zDC%2BNlqYnVpqf%2BdlqPPyvz7M247LU%2FAWQO5uy83Zji%2FayZp1eeTxuOeOUwbv9d%2Bq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb4c7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/sw/sw6163354.js?var=7296273&var_3=null&var_4=null&ymid=12026&ab2_ttl=5184000000 | 104.21.58.91 | 200 OK | 1.0 kB |
URL GET HTTP/3shaudaunsoam.com/sw/sw6163354.js?var=7296273&var_3=null&var_4=null&ymid=12026&ab2_ttl=5184000000 IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (1013), with no line terminators Hashec6b07412caa38d80ee588c50a1fec6b 9975d428abbb929a152bfd0cf0c8305ab4aa3498 381cbb5f49feb363644f6f889b33dd7bd3e17f3cfbf5490387758bd9ada5c03b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /sw/sw6163354.js?var=7296273&var_3=null&var_4=null&ymid=12026&ab2_ttl=5184000000 HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:52 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=1321
etag: W/"662b7650-529"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GPblni9owtk3d%2FgB%2B34XXs1qfKDN6j4m28WjC5vMVFPQo37aLD8qyrCZieYDf%2BLeJ%2FAav%2Bmrz%2FQbdndFzkh7Q0Bbj7%2BFba5VL5f1d7Ldy0qu4jzAFz7wg5%2BtjV2UZFDhsZDU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ffd067131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/s-checkLocalStorageAvailable.ts.f2fef93d.js | 104.21.58.91 | 200 OK | 330 B |
URL GET HTTP/3shaudaunsoam.com/js/s-checkLocalStorageAvailable.ts.f2fef93d.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (338), with no line terminators Hash9a78659da737fccc89546e61f0eb6213 84e705584bdbc81715e0326742f426c2f472d3a9 bb46fe2e65cc91e5a01a8e731754fdc9b8f30813835a673bd96b48672ac82d60
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/s-checkLocalStorageAvailable.ts.f2fef93d.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7652-14a"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=paIWntY9pBkUDdydeuj50fKuTYh9bWB%2BPftJEWc%2F1yp6DbSwPVGrpzSFkzrLyCxsP2zji%2FDHpyKdm%2B55j9TXOOy44ec5QVZW8kFLg3O%2BFqWlZOa0IIpmXBQOkyc%2Fdx%2Bm0VCQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfcc7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-node.js.28d8082c.js | 104.21.58.91 | 200 OK | 6.3 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-node.js.28d8082c.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (6337), with no line terminators Hashb11cf8c1d8d8183e4d11a8f17a41189c 2f912e66ec3992d21e66e7c8e4ff40a2142a4d64 9e69f7af4cfb7fa8b5eb0d67ed8a36f5d23c276ba29b7209565faefab84b71ba
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-node.js.28d8082c.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-186b"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=02QpieT3eeezldonFNz6lLCXr7Wdn793jyGETuNjn5F%2FwHK%2FPlIdFKtllaJx7dV0buXWNvhSuUHF9OUOLBZ8w12C7ssqjNWfgthxKaeTkMcgLinSydyoMsQ8air8G5ZEEugR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb2d7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/css/_core-survey.d3ac2ee0.css | 104.21.58.91 | 200 OK | 83 B |
URL GET HTTP/3shaudaunsoam.com/css/_core-survey.d3ac2ee0.css IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with no line terminators Hash30d726a40ffe74d794b282ca1795b44c b43155653a1b9cc8d257687df9a75e0f204db348 4916da6d6e00e0e6681cccaf9107eb45fdfc78fe2e476444623c30a64959b5e4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /css/_core-survey.d3ac2ee0.css HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=84
etag: W/"662b7650-54"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QbmxXs61GMOY5k9nxnwUI1twDJ9wOslOdWsKg476H3yD7kACbI56TVwjDeVodqP3iAUG%2F44M3k4EWiV5WZlEsSjdxjOeg%2BFR52RVPzeCLKYXvoywzPFdK1wa4Xi5Z25rI%2Bjs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ceff27131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-index.mjs.19622407.js | 104.21.58.91 | 200 OK | 35 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-index.mjs.19622407.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (35287), with no line terminators Hash1de1ec2d8e7940b88970d8fbce40ed6d 510aa24127fb8bc3578d9ca4628b2eea5a84ce01 b473156bef833bcfb2e84658093f1ebc1e64011dcba904e26ccb31f1cad8b762
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-index.mjs.19622407.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-89d7"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NOarzZB93LQb%2FluWY4kiJJGGQQxVV3B8sv3Eark4434KJ49QAyPUXlavJiof0%2FaEfqmd9CwK6fUknL%2FvW41XJJx3qkjZ2GF8GhFbsTXRM%2Bmd8GEyGNQZgPSFXkN8UrBsmB2t"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb2a7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-domparser.js.97173b2e.js | 104.21.58.91 | 200 OK | 1.7 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-domparser.js.97173b2e.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (1772), with no line terminators Hash46dd2964e007bc585a8f72ed695089e8 d02de9abf34cf05d707899e2562c067a8e5326bc 96d95d967e2f5ca4a1be19cf0d21f756ba2d0295ad5f4e967048054e85f6072f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-domparser.js.97173b2e.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-6b8"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4pESAZrVV2GsTL6O56xFZaizESyCQAFDFrzEl0KASD0uoiUs0mgRwIQT7VH%2BXC0fT8ZAMqSF2vNQo7TRnkHV1IhAGvloNfbKFjxmw2pkYj%2Bw%2BN8FvupPSmzfF0%2FAYswwN8hw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb387131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-possibleStandardNamesOptimized.js.205abacb.js | 104.21.58.91 | 200 OK | 7.6 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-possibleStandardNamesOptimized.js.205abacb.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (7923), with no line terminators Hashf80cb2aef29b4a80d135d1a598ce1dfa 0653306df1fd8d8591f84661643825e41684d3f6 43c16ae11cea687efa4ca55dec516b23257c3fcb22c9d3541041f1816aaa7b5b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-possibleStandardNamesOptimized.js.205abacb.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-1d99"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bR7PEloD%2BPB%2FW0FlGbnhNnrT1QozlqpxNlqKBUiJHm8%2FYxBa4bQpu3BnvSOv6ZNqxxwLHU5c6oF6uBgxahHQD9UOP0Xbd34nqLfs%2Bj4mHPpPTjq3LagS0zmAGC1oWrmffbDD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb2f7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-html-to-dom.js.ff1ae7e0.js | 104.21.58.91 | 200 OK | 364 B |
URL GET HTTP/3shaudaunsoam.com/js/v-html-to-dom.js.ff1ae7e0.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (373), with no line terminators Hash57f543d4f79657dc92755e2f2031da65 4884f924743049d7812b58958633a40f65e159b5 0fcc39a4a2b765b1ed92a6093fe6dc70e0a886914746f5af6fda6e3d1dc7417d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-html-to-dom.js.ff1ae7e0.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-16c"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ypNhgR6%2Brl56RFWRvvVjMaC%2FjGrZJVU1ED07ov56CFz76R6LHHWT5RXzwo6CwI%2BF3jKVnOJpqkY%2FRwZMlR2lfoC5szZDc%2BO%2Ba6wdZe2nbXu6locvQORxKjLe7GGHuotobkBk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb4e7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/sweeps-survey.724f05c4.js | 104.21.58.91 | 200 OK | 5.8 kB |
URL GET HTTP/3shaudaunsoam.com/js/sweeps-survey.724f05c4.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (6111), with no line terminators Hash8f7b854a31f40bf9be7af8ea81b5f176 bd2ea265c24d6147930a142b34527dcb4d55879e 0f7d320f1c7de2e4777cf2a8c99fb464188c4d196fb82c640f6d1b3d6f592cce
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/sweeps-survey.724f05c4.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-16d0"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1K0hWFhyNdAykEHiaHuR6eeJrDvgHRzVqLsMPMmVA1cf8lba8TtQEXM%2Flc1h%2BuppSk119rtdMAdbSGY0GRybP1Gutvdl9WqbxLDb1M5CjtxfehkpioOutyiKVk5lQkDebdXU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ceff07131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/v-dom-to-react.js.26fdf751.js | 104.21.58.91 | 200 OK | 1.1 kB |
URL GET HTTP/3shaudaunsoam.com/js/v-dom-to-react.js.26fdf751.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (1101), with no line terminators Hash5693cb2629dd3231ce6fed788c41b150 872d71cae7dddc37389be6bae0fc4a5b611ec9c0 b312636bf1d349d818517865e89c22f8b9ef9e61d1805cf315e44241ccc05d26
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/v-dom-to-react.js.26fdf751.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-43d"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3179
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JmB%2BHdRJEpxKIRvwMk4BGPXNXg3R0EsSZRXpSWJc4It3wqsF%2BFogN0ZmvejD94hiTkA6xt8IEIBzsHiUrm8uXMOEpFGilR3u2WLVtC8eyQ7UsdbOQ%2FDHm0JMzwYEw8PEIUyk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb457131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/s-storageService.js.bb9f7a22.js | 104.21.58.91 | 200 OK | 2.2 kB |
URL GET HTTP/3shaudaunsoam.com/js/s-storageService.js.bb9f7a22.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeJavaScript source, ASCII text, with very long lines (2216), with no line terminators Hash803fe057e4762b54a284184815cfb62e e748b6c77988934fe2b458b61a93e35f22cfecbc 0552fbab13dd0597298180b4d1c5e1a8a2ca66e121e3ab892f100366c8d45d3c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/s-storageService.js.bb9f7a22.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-87a"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGFNtz%2FxakEGeSAF5nN4KCGy9Ifl7yNLQAn2MvlhrmSCZpJ2M1BN5C408a9stP8mqKXT0t0%2BO%2BstW5KfehCOaUv9pvFgDijNQtyyUkm3oC60Acz2E6yYXdLEoAz0LPQBHdd1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cdfc97131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/config/sd/sd-3983-en.js?v=10 | 104.21.58.91 | 200 OK | 6.1 kB |
URL GET HTTP/3shaudaunsoam.com/js/config/sd/sd-3983-en.js?v=10 IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (6364), with no line terminators Hash393964f0f170398158701313e2864602 284d16d89faaaff80f695dbbbc6c9263cd2df81c 9c6adc425d55f88c232f92bcd4a9a0a64c2b25741d3aaeceb37e7134e81b39b8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/config/sd/sd-3983-en.js?v=10 HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
vary: Accept-Encoding
etag: W/"662b7651-17ec"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cACT6IwgBajbYY1UYDfx1lc1%2F8FJSx9MFE%2BJOCzet9M%2Fzid1IYbsMnR543C2aqO9yXAU5gzBOhadfey7rtigPy34Vivr12WZNEQW3bdjbA6h3uUsxo3A%2FL35XZJNhF%2BmC3iJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209d99177131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/_core-survey.1b09882a.js | 104.21.58.91 | 200 OK | 170 kB |
URL GET HTTP/3shaudaunsoam.com/js/_core-survey.1b09882a.js IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
Size170 kB (169673 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/_core-survey.1b09882a.js HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=169676
etag: W/"662b7651-296cc"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 3181
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YpcuYMthGfST1UoflPSeKgFjEqlzlWa%2BLcvcORpg61DuwWRbgfNEGmVl7VV%2F%2BcmT4tfTrls71x8%2BtlWGZzTwXP3sQE6W6qXRPTIHP9ApJgxpCWjMnfAkitbPa%2B1KqQnx9wgF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209cefe57131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| shaudaunsoam.com/js/config/comments/en-sweep.json | 104.21.58.91 | 200 OK | 4.9 kB |
URL GET HTTP/3shaudaunsoam.com/js/config/comments/en-sweep.json IP104.21.58.91:443
Requested byhttps://shaudaunsoam.com/sweeps-survey.html?z=7296273&offer_id=3983&var=12026&ymid=136dlvs5g0082 CertificateIssuerLet's Encrypt Subjectshaudaunsoam.com Fingerprint90:70:D4:0B:5E:24:64:5D:7E:4D:A7:DA:D4:3C:30:07:06:8E:2E:65 ValidityMon, 08 Apr 2024 14:02:49 GMT - Sun, 07 Jul 2024 14:02:48 GMT
File typeASCII text, with very long lines (5602), with no line terminators Hashe365b2a50ff785aa57118984ebc86b5d 0cf187164eaa42ff7e244ba653bbde659feaa5bc 3094a84e8e909474fae4e0db6685d9b407d4493efd9389efe35caf326c95a6f0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/config/comments/en-sweep.json HTTP/1.1
Host: shaudaunsoam.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji; syncedCookie=true; oaidts=1715356671; ID=7uo8e8bqt4b7hmiiquoc3wre030ik0ji
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 15:57:51 GMT
content-type: application/json
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-12f9"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=muB6aBKyHyKC%2BNHLK0PP0cxl%2FZozdgxylhJ4LhMFW6m37JQA4%2BOb0cP%2FnjwENvB3gIxbvTR%2BrTYDw0zmYa0oN3pbqBuH733chdFkaZETThBiKQX0VWazEzuN1KTtW18ngD7N"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 881b209ecb1f7131-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|