gsbxrt54.blogspot.com/?m=1
200 OK 20 kB URL User Request GET HTTP/2 gsbxrt54.blogspot.com/?m=1
IP
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint07:E2:99:33:66:25:16:0A:1D:C3:C7:18:D8:82:4A:F0:37:40:E1:5B
ValidityMon, 23 Oct 2023 11:23:28 GMT - Mon, 15 Jan 2024 11:23:27 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (12390)
Hash 58941d4529ab1c4a6296009e4331311b
131f41aab89146ccb0db38f984f7e796c207a869
0435cddd3c4924a5e7a3e7a32b201e1d0517ee671033ef2948d533b703e3a34b
GET /?m=1 HTTP/1.1
Host: gsbxrt54.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
expires: Mon, 04 Dec 2023 05:48:27 GMT
date: Mon, 04 Dec 2023 05:48:27 GMT
cache-control: private, max-age=0
last-modified: Wed, 20 Sep 2023 00:23:28 GMT
etag: W/"35349b8d3a32b645437459573a55b8b646c0a074df37077ebd5d04e657dd128d"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 20387
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
gsbxrt54.blogspot.com/js/cookienotice.js
200 OK 2.0 kB URL GET HTTP/3 gsbxrt54.blogspot.com/js/cookienotice.js
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint07:E2:99:33:66:25:16:0A:1D:C3:C7:18:D8:82:4A:F0:37:40:E1:5B
ValidityMon, 23 Oct 2023 11:23:28 GMT - Mon, 15 Jan 2024 11:23:27 GMT
Hash a705132a2174f88e196ec3610d68faa8
3bad57a48d973a678fec600d45933010f6edc659
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
GET /js/cookienotice.js HTTP/1.1
Host: gsbxrt54.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/?m=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 2026
date: Mon, 04 Dec 2023 05:48:28 GMT
expires: Mon, 11 Dec 2023 05:48:28 GMT
cache-control: public, max-age=604800
last-modified: Mon, 04 Dec 2023 00:51:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
200 OK 7.8 kB URL GET HTTP/2 www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type ASCII text, with very long lines (35959)
Hash 1e32420a7b6ddbdcb7def8b3141c4d1e
a1be54d42ff1f95244c9653539f90318f5bc0580
a9ca837900b6ae007386d400f659c233120b8af7d93407fd6475c9180d9e83d2
GET /static/v1/widgets/3566091532-css_bundle_v2.css HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 7756
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 12:58:11 GMT
expires: Thu, 28 Nov 2024 12:58:11 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 29 Nov 2023 01:58:19 GMT
content-type: text/css
vary: Accept-Encoding
age: 406217
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
resources.blogblog.com/img/icon18_edit_allbkg.gif
200 OK 162 B URL GET HTTP/2 resources.blogblog.com/img/icon18_edit_allbkg.gif
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type GIF image data, version 89a, 18 x 18\012- data
Hash c991641178ff05adf0d004298b5eafa9
d8f6ce8ecd92b86d49849360f6b81ceb10b4c941
ca9848e6006cfec8f9ffa29433ade8152204bdb95579200831c6dc0f53dff70b
GET /img/icon18_edit_allbkg.gif HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 162
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 14:29:38 GMT
expires: Wed, 06 Dec 2023 14:29:38 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2023 05:57:17 GMT
content-type: image/gif
age: 400730
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
apis.google.com/js/platform.js
200 OK 22 kB URL GET HTTP/2 apis.google.com/js/platform.js
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.apis.google.com
Fingerprint06:87:C0:63:02:21:98:02:BD:FC:A0:11:93:E9:3A:9F:51:21:06:D8
ValidityMon, 23 Oct 2023 11:25:10 GMT - Mon, 15 Jan 2024 11:25:09 GMT
File type ASCII text, with very long lines (2664)
Hash fd67324a3d81895bdf76b073089663b1
5abb1b0a36c645085e31830e6647faa790ad4e91
8eaa06f95fa0ac44c2c186f200874f2f3ebc3aaa92412f0d0c096f517d3581d1
GET /js/platform.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length: 21930
date: Mon, 04 Dec 2023 05:48:28 GMT
expires: Mon, 04 Dec 2023 05:48:28 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "bccfddc1dce4fb76"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
set-cookie: NID=511=VAEeYHVk87-tOTRVPObAv6aCrDXkalzWuYqBruvo5GmHlgfA4bxi0CS12xNB1ROsjecKS_m4lxOAWhVVr_4Q-hYCDWGyrNTruUi3rrRqm3DGRuYgo0_rpWA47AVVwaqxv0WV2cUShlocHl68cT6UQ34R-yhxGsSVf5OZ-rueonQ; expires=Tue, 04-Jun-2024 05:48:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
www.blogger.com/static/v1/widgets/3754116945-widgets.js
200 OK 59 kB URL GET HTTP/2 www.blogger.com/static/v1/widgets/3754116945-widgets.js
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type ASCII text, with very long lines (2258)
Hash 0f3580b0033bbd151cdb647634be7404
4d8508ef28b0e50fa8c28ccaeb1f2a6855a75bdc
38d944d88c98612f76ed693afb143f1c032ca27ba56ec46a6714ab3dc511f974
GET /static/v1/widgets/3754116945-widgets.js HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 59286
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 01 Dec 2023 01:58:17 GMT
expires: Sat, 30 Nov 2024 01:58:17 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 30 Nov 2023 23:28:54 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 273011
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs
200 OK 61 kB URL GET HTTP/3 apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (1505)
Hash 71aaa92f748ba3c48d6edfb40204d614
ad1ca8c338494256d564ee7857707f758e03948b
215f3b01f5decd286eb88ac2dc56b997e6cd2ce8f47998dfa9e2917f8b890982
GET /_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes,gapi_iframes_style_bubble/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Cookie: NID=511=VAEeYHVk87-tOTRVPObAv6aCrDXkalzWuYqBruvo5GmHlgfA4bxi0CS12xNB1ROsjecKS_m4lxOAWhVVr_4Q-hYCDWGyrNTruUi3rrRqm3DGRuYgo0_rpWA47AVVwaqxv0WV2cUShlocHl68cT6UQ34R-yhxGsSVf5OZ-rueonQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 60962
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 20:26:33 GMT
expires: Thu, 28 Nov 2024 20:26:33 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 08 Nov 2023 22:37:21 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 379315
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
resources.blogblog.com/blogblog/data/1kt/travel/bg_black_70.png
200 OK 84 B URL GET HTTP/3 resources.blogblog.com/blogblog/data/1kt/travel/bg_black_70.png
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type PNG image data, 5 x 5, 8-bit/color RGBA, interlaced\012- data
Hash 4fc6c14642616095c0b1c90baa826951
25cacf250fad4290661fe8849069769f4eb40aba
4f01951293a11116b89b6e19f70cb9b72b2e3a68b2005c75d1d9b8e7b85eb35a
GET /blogblog/data/1kt/travel/bg_black_70.png HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 84
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 13:47:18 GMT
expires: Wed, 06 Dec 2023 13:47:18 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2023 06:55:06 GMT
content-type: image/png
age: 403270
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/img/share_buttons_20_3.png
200 OK 5.1 kB URL GET HTTP/3 www.blogger.com/img/share_buttons_20_3.png
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type PNG image data, 120 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash ad9999106d5f550920b586e8e1704e5a
93fd02c51166402a41f96509cd0ca3fb917877dd
3829a5b2ade7cfc416c80b8f3df71e49e68672875f025d525223978f5cee3fd3
GET /img/share_buttons_20_3.png HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 5080
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 04:00:50 GMT
expires: Thu, 07 Dec 2023 04:00:50 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2023 17:00:16 GMT
content-type: image/png
age: 352058
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
pagead2.googlesyndication.com/pagead/js/google_top_exp.js
200 OK 42 B URL GET HTTP/2 pagead2.googlesyndication.com/pagead/js/google_top_exp.js
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.g.doubleclick.net
Fingerprint6C:2A:75:F2:3F:EF:4F:43:B1:8D:C3:B7:E9:2E:4A:EF:40:6A:FC:92
ValidityMon, 23 Oct 2023 11:18:19 GMT - Mon, 15 Jan 2024 11:18:18 GMT
Hash 7f5f2be159837d73b72a4b37616bce44
c93d7f25b530b05c26440d3352213b683d03dcc3
ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2
GET /pagead/js/google_top_exp.js HTTP/1.1
Host: pagead2.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: br
server: cafe
content-length: 42
x-xss-protection: 0
date: Mon, 04 Dec 2023 05:09:42 GMT
expires: Mon, 18 Dec 2023 05:09:42 GMT
cache-control: public, max-age=1209600
age: 2326
etag: 13036835877489095579
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
themes.googleusercontent.com/image?id=0BwVBOzw_-hbMMDYxYTU0MmQtZTA5Yi00MTIwLTk3ZjktZWI4MzJhMDQyOTIy&options=w1600
200 OK 175 kB URL GET HTTP/2 themes.googleusercontent.com/image?id=0BwVBOzw_-hbMMDYxYTU0MmQtZTA5Yi00MTIwLTk3ZjktZWI4MzJhMDQyOTIy&options=w1600
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE
ValidityMon, 23 Oct 2023 11:23:50 GMT - Mon, 15 Jan 2024 11:23:49 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1600x1200, components 3\012- data
Size 175 kB (175393 bytes)
Hash 359a5af1d060f96dac5ec6722020fd9b
59cc829ba436808815c861c8c2c6569dfa347bad
32857ace37e09e680df7b2bdf1198ae628992cc2b7eb624ae40e4c8f0815e8bd
GET /image?id=0BwVBOzw_-hbMMDYxYTU0MmQtZTA5Yi00MTIwLTk3ZjktZWI4MzJhMDQyOTIy&options=w1600 HTTP/1.1
Host: themes.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
etag: "v1"
expires: Tue, 05 Dec 2023 05:48:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 05:48:28 GMT
server: fife
content-length: 175393
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
lh3.googleusercontent.com/blogger_img_proxy/ALY8t1vO8xjqN0qmc0I4_4T3JwyaiwyrIS2Ng2TIA-QNwX2oHkgsJNBsx5XsljUHYNYa6TOP2AJJq44RPUyCGtMTuS1lk0ePb8_it97-HsI01cKL3tbz-XAQr-dqkdJzwsk_f-rqQfp46PLjshRIKGMtLD4K03uRhDX1CaDtm76z5sQBMC4=w72-h72-p-k-no-nu
200 OK 4.2 kB URL GET HTTP/2 lh3.googleusercontent.com/blogger_img_proxy/ALY8t1vO8xjqN0qmc0I4_4T3JwyaiwyrIS2Ng2TIA-QNwX2oHkgsJNBsx5XsljUHYNYa6TOP2AJJq44RPUyCGtMTuS1lk0ePb8_it97-HsI01cKL3tbz-XAQr-dqkdJzwsk_f-rqQfp46PLjshRIKGMtLD4K03uRhDX1CaDtm76z5sQBMC4=w72-h72-p-k-no-nu
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.googleusercontent.com
Fingerprint2E:01:38:64:37:3C:F9:F4:3C:95:49:F1:9E:D9:61:5F:63:48:CF:CE
ValidityMon, 23 Oct 2023 11:23:50 GMT - Mon, 15 Jan 2024 11:23:49 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 72x72, components 3\012- data
Hash 99d8cb95493bd75c4234b7e3feede93a
ba8ac8d50e7464c569fee00bbe2f13f8bb539693
fcb7954899c71e4416299ba6c8015908be1a2c32acbe4ceadb3f53e40953a90a
GET /blogger_img_proxy/ALY8t1vO8xjqN0qmc0I4_4T3JwyaiwyrIS2Ng2TIA-QNwX2oHkgsJNBsx5XsljUHYNYa6TOP2AJJq44RPUyCGtMTuS1lk0ePb8_it97-HsI01cKL3tbz-XAQr-dqkdJzwsk_f-rqQfp46PLjshRIKGMtLD4K03uRhDX1CaDtm76z5sQBMC4=w72-h72-p-k-no-nu HTTP/1.1
Host: lh3.googleusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/jpeg
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
access-control-expose-headers: Content-Length
expires: Tue, 05 Dec 2023 05:48:28 GMT
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
x-content-type-options: nosniff
date: Mon, 04 Dec 2023 05:48:28 GMT
server: fife
content-length: 4168
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ichef.bbci.co.uk/news/800/cpsprodpb/790d/live/2d24a3b0-9a3a-11ed-aa33-31aea7c86895.png
200 OK 59 kB URL GET HTTP/2 ichef.bbci.co.uk/news/800/cpsprodpb/790d/live/2d24a3b0-9a3a-11ed-aa33-31aea7c86895.png
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGlobalSign nv-sa
Subjectwww.bbc.co.uk
Fingerprint85:33:F7:4B:FF:4B:76:4B:06:E5:52:7A:14:05:C8:91:83:4F:C4:98
ValidityWed, 25 Oct 2023 10:57:08 GMT - Mon, 25 Nov 2024 09:46:02 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPCM), density 47x47, segment length 16, baseline, precision 8, 800x450, components 3\012- data
Hash 5fb0a44cd50dc549b4e3884e1f3e5c08
65413617fbeb6900cba3f6967a6c902f5a3bd65a
7786c51d21f30b87cfb4a78b9ba1eb37b8d1a4c759a5689070a39dd12cb2eebe
GET /news/800/cpsprodpb/790d/live/2d24a3b0-9a3a-11ed-aa33-31aea7c86895.png HTTP/1.1
Host: ichef.bbci.co.uk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: AmazonS3
last-modified: Sun, 22 Jan 2023 10:15:50 GMT
etag: "c1b53741f4ea767f6a642caddde2ebb8"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
content-type: image/png
content-length: 59175
expires: Tue, 03 Dec 2024 05:48:28 GMT
cache-control: max-age=31536000
date: Mon, 04 Dec 2023 05:48:28 GMT
timing-allow-origin: https://www.bbc.co.uk, https://www.bbc.com
access-control-allow-headers: *
access-control-allow-methods: HEAD,GET
access-control-allow-credentials: false
access-control-max-age: 300
access-control-allow-origin: *
X-Firefox-Spdy: h2
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:28 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 3427e33f541e5de9b597421dc075a3cb
Strict-Transport-Security: max-age=0; includeSubdomains
www.blogger.com/dyn-css/authorization.css?targetBlogID=7899550520183288334&zx=a6dda919-e92c-486f-aa67-f613013459c6
200 OK 21 B URL GET HTTP/3 www.blogger.com/dyn-css/authorization.css?targetBlogID=7899550520183288334&zx=a6dda919-e92c-486f-aa67-f613013459c6
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type very short file (no magic)
Hash 68b329da9893e34099c7d8ad5cb9c940
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
GET /dyn-css/authorization.css?targetBlogID=7899550520183288334&zx=a6dda919-e92c-486f-aa67-f613013459c6 HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/css; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 04 Dec 2023 05:48:28 GMT
last-modified: Mon, 04 Dec 2023 05:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-length: 21
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
2.6 kB URL www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
IP
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3170)
Hash 7a185ea54ce78ef29ff88208e40b81e4
2ce02c637210d52717004e9e3badb2f9e778872f
2d8d763542a52a67d7df0bdabe2161abed33732a42781d6619f414211f1fbba6
GET /navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 04 Dec 2023 05:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 2569
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:28 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7671f33f73404416865ce2f4fcbb2927
Strict-Transport-Security: max-age=0; includeSubdomains
resources.blogblog.com/img/navbar/icons_peach.png
200 OK 907 B URL GET HTTP/3 resources.blogblog.com/img/navbar/icons_peach.png
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fgsbxrt54.blogspot.com&pfname=&rpctoken=32088306
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type PNG image data, 46 x 20, 8-bit colormap, non-interlaced\012- data
Hash 3718077fe5eb689b0ded987a52881d06
f0ce5596ef43f850c400cbbc0556697fb3e7b232
72be8098b87d7e2d7fbc6eb0a3eaebcf1013186d7733cd340549f9e1701a4865
GET /img/navbar/icons_peach.png HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 907
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 11:28:24 GMT
expires: Thu, 07 Dec 2023 11:28:24 GMT
cache-control: public, max-age=604800
last-modified: Thu, 30 Nov 2023 06:30:42 GMT
content-type: image/png
age: 325205
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
resources.blogblog.com/img/navbar/arrows-light.png
200 OK 117 B URL GET HTTP/3 resources.blogblog.com/img/navbar/arrows-light.png
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fgsbxrt54.blogspot.com&pfname=&rpctoken=32088306
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type PNG image data, 19 x 4, 8-bit/color RGBA, non-interlaced\012- data
Hash 25c2b0cfe0ad4dcda4a0e3727d091d80
b9d16f4311e64648b7970baf00cb9841e3c3351b
bb6685107846b4c25384202730b84ec168fecee197e5f9e3fe8ffdd5bed6749d
GET /img/navbar/arrows-light.png HTTP/1.1
Host: resources.blogblog.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 117
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 02:02:35 GMT
expires: Thu, 07 Dec 2023 02:02:35 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2023 17:00:16 GMT
content-type: image/png
age: 359154
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
apis.google.com/js/platform:gapi.iframes.style.common.js
200 OK 22 kB URL GET HTTP/3 apis.google.com/js/platform:gapi.iframes.style.common.js
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fgsbxrt54.blogspot.com&pfname=&rpctoken=32088306
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (2664)
Hash b970f4ece0f21dae7d57dcbbbe1eb48b
52ab98370d3fc4bfd4c1b23cb3ed5dc1e37d779a
53dbcf2ac8d4a8d0a0fc4d5a15778fd36664923c87a60891a87bf8ec45535a91
GET /js/platform:gapi.iframes.style.common.js HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Cookie: NID=511=VAEeYHVk87-tOTRVPObAv6aCrDXkalzWuYqBruvo5GmHlgfA4bxi0CS12xNB1ROsjecKS_m4lxOAWhVVr_4Q-hYCDWGyrNTruUi3rrRqm3DGRuYgo0_rpWA47AVVwaqxv0WV2cUShlocHl68cT6UQ34R-yhxGsSVf5OZ-rueonQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/javascript
access-control-allow-origin: *
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="gapi-team"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
timing-allow-origin: *
content-length: 21940
date: Mon, 04 Dec 2023 05:48:29 GMT
expires: Mon, 04 Dec 2023 05:48:29 GMT
cache-control: private, max-age=1800, stale-while-revalidate=1800
etag: "f3d0fc258127dfc5"
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d9494bf17c426af4f6e66fa02d0f80d2
Strict-Transport-Security: max-age=0; includeSubdomains
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs
200 OK 46 kB URL GET HTTP/3 apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs
IP
Requested by https://www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fgsbxrt54.blogspot.com&pfname=&rpctoken=32088306
Certificate IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint4C:0D:17:8C:F1:30:7C:3A:6F:9B:8E:B4:83:0E:5C:BD:ED:17:3E:95
ValidityMon, 23 Oct 2023 11:18:24 GMT - Mon, 15 Jan 2024 11:18:23 GMT
File type ASCII text, with very long lines (1505)
Hash a5139ae5276fac825f580dd8b48d0f72
2820e165c330673129cebdc8e7cf806e1620c0a0
2170ad362c9ba9f7ff9b642d2a9d72a263fff1cd47de3664c55d6a7462c4cbc3
GET /_/scs/abc-static/_/js/k=gapi.lb.en.coKrc9A11Ng.O/m=gapi_iframes_style_common/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw/cb=gapi.loaded_0?le=scs HTTP/1.1
Host: apis.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.blogger.com/
Cookie: NID=511=VAEeYHVk87-tOTRVPObAv6aCrDXkalzWuYqBruvo5GmHlgfA4bxi0CS12xNB1ROsjecKS_m4lxOAWhVVr_4Q-hYCDWGyrNTruUi3rrRqm3DGRuYgo0_rpWA47AVVwaqxv0WV2cUShlocHl68cT6UQ34R-yhxGsSVf5OZ-rueonQ
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-length: 45499
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 29 Nov 2023 18:39:38 GMT
expires: Thu, 28 Nov 2024 18:39:38 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 08 Nov 2023 22:37:21 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 385731
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fcb662b1f571ad39cec79032adc5d0ad
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 456b98e41c89d427e50c9c8d58085886
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2789c4dfcc1806cefacd56e6ba270c13
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1139b702af80f3eb0b5df9209f6caa39
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 36aaf80121bce1bf55d9a7330fa51ea7
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:29 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: aa798ace0f01ada2afd42e6086421eaa
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Mon, 04 Dec 2023 05:48:30 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fb16750fe16153202a83b598c0257b9f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:30 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e85fb43f20a118803561854b487dcab6
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:30 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: eff5597c55cad7a389a71f3f77962d30
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:30 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 89440a3ac5f1fc37b02534baa3e379f3
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:30 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0d5282e49cd9985c8c7204e808edb91e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b31e97c7c0ba162432c96d3b126b7508
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ef272f81bc7b88d98ece73a90109f1b1
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a7a6ff0da4fa8de4c6e9b4c18987befe
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 3c2c9fc7014935ecd84e9dc8a77b8c98
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 814c23e4f5e21274f419de32873e6df5
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:31 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 429b0db69660a08225ffa68eedad9b94
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 22aee26338479825b57cde4407cd25f8
Strict-Transport-Security: max-age=0; includeSubdomains
www.blogger.com/img/logo-16.png
200 OK 279 B URL GET HTTP/3 www.blogger.com/img/logo-16.png
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Hash 5ffecab6c722bb0adc3fce8d83b27993
0e59b05d3da526e82bb4f5d47c5d94e2a318dafb
cca664ca16fde285160e80eae6ba4501c27b1dd1ce09aec1e84caa74b5baff53
GET /img/logo-16.png HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-length: 279
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 30 Nov 2023 05:01:18 GMT
expires: Thu, 07 Dec 2023 05:01:18 GMT
cache-control: public, max-age=604800
last-modified: Wed, 29 Nov 2023 19:59:28 GMT
content-type: image/png
age: 348434
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f0f77ca7b5d7a9f65d83e654a9f2b13b
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d12d52e95314af1b154724c33b244afc
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 68e99a36cfe57d87711f65c34dea639f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 35d6770ae904ae11e7b44df56d2257a1
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:32 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 767c94a9c8feb37304bbd7e94dc8a9b1
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:33 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 75d44564609c756a889756c64ab29ad5
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:33 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 3939cf39289851a7c5528c2ba36daa46
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:33 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 78971dcff360a7e7fc3cc4975459d1ef
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:33 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d3430a09b1bc48f4909e0405a10fa547
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1f2247088c7c17635968a123334a1a54
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 41edc83f5f38def109df9f95b6f3344d
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ae8848701291a2ed93f5038eada586ee
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4381bbabb700704e7e116de4d0331457
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6f7101fe234f8149d1ea956974bd1105
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9f43334fa3d4e1ebbf5aaeed58856b5a
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1e5e13fd97f890a0d94cab510188d59c
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:34 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 90d68f1f37b364f5e5db30755748a0d4
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 44a1a900c09c97b67882a7c64d9028ea
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4c7dcfc3c8963941c2fd01bfd4cff0ce
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7f77b9ca32c7862ea1015d2c8da37d50
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a4a08b4cb900ef0d251ce1dfb32f775b
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 628ef4c23e12ae4adf7ac8c9fa750002
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:35 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 1fc679d9dd75ec9523ab43ceeb201cda
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 5074fc3c6af07be111e82379b187660f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0e066037894bcc244e6be6331abe96f5
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b54c1d473264fa323fd223f727c5dc3d
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 03d38daf52897688f8769e3783d8a5fb
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ee53caaac6d0503b184f9281619bbf48
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:36 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 7fd23c879b50f272534ec623ee5a1ec9
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6f90b3333a78d58619099eeca219e643
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b523ed248bb89018a926a9f872d9f291
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 823f3b35f6d071d93fc29ae966b13d04
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a3fdc86167063346022168229197b4fe
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2005aece1ad471bcfeda7e2f09743138
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c2a4b9820610ae8b27e07813f868f17e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:37 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9848350a0c8d626fad9f9b30ee1db8a8
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:38 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 49521e34d0d5244834409865f9cd1e36
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:38 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 50e7e0f608739a3047db70b3fb94f12c
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:38 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b018fd89aaf69b565efa623e1a332ecb
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:38 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d89ff823ff2a74903137a68ce8e9632f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:38 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 27d74415d42cd248edafd5d26d4c162f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 46738ce20ee7dd55b01c4d1b138a36f6
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: bd061704e4462d460528e47e05fbcc89
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f26394fc28fee7ce5fb7db44067e0cfc
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c23ba061a3e5b866ead7541ab132287b
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 6511770e6901b086b072eed2bd1c1ecf
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8350e13f14ac7b3457a70a221f353daa
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d063497b891dc4b6365d695fbe49766f
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:39 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 336d381b76e07be777b0e18e1b3514d9
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:40 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ae0fe999605bde6858b299ed96badf44
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:40 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 22c4f9087429e09af28b7ab8d0703a01
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:40 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fb246656487bd132d364116db9a3aeeb
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:40 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0d311653caf92489fc138d40596bae62
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:40 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: af6ad520ceb6af84f58a091cb18d1757
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:41 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e0647c7c9983b877a8f2c6d6d3f364b0
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:41 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 10b6d2846acba1f5876cc551d506286e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:41 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 68cb33d8981b48852578812db0bde5af
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:41 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 333134b7c7b60e98b96c3a5c9149c9e5
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:41 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 571919cbb8f2addd88b72bcf89b87a8e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4dfae4ef409323c9ef988cee5befb725
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ab8d7e1ee5d7245106a4acae4373d0ea
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 45417ca618d34764b3a322b47741bf7d
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: fd52cfeaa46d91a65847cfc036e3c1bf
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6357a9139573fea1427f4d527ab2324b/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6357a9139573fea1427f4d527ab2324b/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 0dd0d837f46d5541b2e6e8d6658e1451
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d1ce21b77b8a9de80990ba8f6e99b885
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: aaccf8d79f2d8baa092ac42534c084ab
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:42 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: b1013766567fc17a8adae2dc43adf482
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:43 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 960d1d4bcce08e1b6d942ad23ba983c9
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/66ef692393ea9b4a2741c5a53a949b52/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /66ef692393ea9b4a2741c5a53a949b52/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:43 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: close
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 2b37cabb402f68976273ad9f3476c6f0
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:43 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: ea1bac28b7c39d8435c19982f6f2cc3b
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:43 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: c67f732911119355f620c233a7520577
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:43 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e0580955cfd672515ad506cd57fcac43
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:44 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 052f8cc8aa4aa5e9ac5f81c9e40ac16e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:44 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 8cc2845cfbe07ea804e04c385b375b8e
Strict-Transport-Security: max-age=0; includeSubdomains
www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
200 OK 0 B URL GET HTTP/1.1 www.effectivecreativeformat.com/6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerLet's Encrypt
Subjecteffectivecreativeformat.com
Fingerprint6A:8F:F6:A0:C1:B6:14:AE:5C:CC:1E:DE:42:5D:60:E8:38:7A:B6:42
ValidityThu, 19 Oct 2023 06:30:20 GMT - Wed, 17 Jan 2024 06:30:19 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert mnemonic secure dns malicious Sinkholed
Quad9 DNS malicious Sinkholed
GET /6e1a747d26ca1dc24c1d5f7f68893cd7/invoke.js HTTP/1.1
Host: www.effectivecreativeformat.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Mon, 04 Dec 2023 05:48:44 GMT
Content-Type: application/javascript
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: d7521f50561a1e14c581a8e40572da52
Strict-Transport-Security: max-age=0; includeSubdomains
gsbxrt54.blogspot.com/favicon.ico
412 B URL gsbxrt54.blogspot.com/favicon.ico
IP
Certificate IssuerGoogle Trust Services LLC
Subjectmisc-sni.blogspot.com
Fingerprint07:E2:99:33:66:25:16:0A:1D:C3:C7:18:D8:82:4A:F0:37:40:E1:5B
ValidityMon, 23 Oct 2023 11:23:28 GMT - Mon, 15 Jan 2024 11:23:27 GMT
File type MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 16x16, 8 bits/pixel\012- data
Hash 59a0c7b6e4848ccdabcea0636efda02b
30ef5c54b8bbc3487ea2b4c45cd11ea2932e4340
a1495da3cf3db37bf105a12658636ff628fee7b73975b9200049af7747e60b1f
GET /favicon.ico HTTP/1.1
Host: gsbxrt54.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/?m=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: image/x-icon; charset=UTF-8
expires: Mon, 04 Dec 2023 05:48:44 GMT
date: Mon, 04 Dec 2023 05:48:44 GMT
cache-control: private, max-age=86400
last-modified: Wed, 20 Sep 2023 00:23:28 GMT
etag: W/"35349b8d3a32b645437459573a55b8b646c0a074df37077ebd5d04e657dd128d"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 412
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
200 OK 6.7 kB URL GET HTTP/3 www.blogger.com/navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__
IP
Requested by https://gsbxrt54.blogspot.com/?m=1
Certificate IssuerGoogle Trust Services LLC
Subject*.blogger.com
Fingerprint4A:89:9B:E5:F1:54:0E:2D:0A:8E:40:A8:27:DF:2E:6B:7F:74:51:90
ValidityMon, 23 Oct 2023 11:17:52 GMT - Mon, 15 Jan 2024 11:17:51 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6854), with no line terminators
Hash c9d440355da06f28ddf4f737e0090103
c2672876e6cb41ada02a287450b149f1df4130b6
89cc4d4f6d68298decff663e78716163f788f5174bbd493bcd00a8835b382e72
GET /navbar.g?targetBlogID=7899550520183288334&blogName=world+news&publishMode=PUBLISH_MODE_BLOGSPOT&navbarType=LIGHT&layoutType=LAYOUTS&searchRoot=https://gsbxrt54.blogspot.com/search&blogLocale=en&v=2&homepageUrl=https://gsbxrt54.blogspot.com/&vt=3961946899378277294&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.coKrc9A11Ng.O%2Fd%3D1%2Frs%3DAHpOoo_J8xjByIzBlcB6zLaAkxsUwdPdIw%2Fm%3D__features__ HTTP/1.1
Host: www.blogger.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gsbxrt54.blogspot.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
p3p: CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-security-policy: script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 04 Dec 2023 05:48:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 2569
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
172.217.21.161
23.195.254.196
0.0.0.0