WEBSITE ANALYSIS REPORT

http://foxtrend.st/event/ppv-portugal-vs-nigeria/admin/1

10 Jun 2026 · 20:17:00.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

adexchangerapid.com1 captured requests
cdn.jsdelivr.net3 captured requests
chat.21aims.shop5 captured requests
embedstreams.top9 captured requests
endfield.gryphline.com5 captured requests
fonts.googleapis.com2 captured requests
fonts.gstatic.com3 captured requests
foxtrend.st5 captured requests
grabpopdownloadnowtoday.monster1 captured requests
lb7.strmd.st2 captured requests
ndcertainlywhen.com12 captured requests
t.tenlets.com7 captured requests
tcliktrc.online1 captured requests
usrpubtrk.com1 captured requests
www.blockadsnot.com1 captured requests
www.gamerhit.co7 captured requests
www.google.com1 captured requests
www.primecinemaapp.com19 captured requests

Connections

chat.21aims.shop → fonts.googleapis.comLoads from1 captured connections
chat.21aims.shop → fonts.gstatic.comLoads from3 captured connections
embedstreams.top → cdn.jsdelivr.netLoads from3 captured connections
embedstreams.top → endfield.gryphline.comEmbeds5 captured connections
embedstreams.top → grabpopdownloadnowtoday.monsterEmbeds1 captured connections
embedstreams.top → lb7.strmd.stCalls2 captured connections
embedstreams.top → ndcertainlywhen.comEmbeds12 captured connections
embedstreams.top → t.tenlets.comEmbeds7 captured connections
embedstreams.top → tcliktrc.onlineEmbeds1 captured connections
embedstreams.top → www.gamerhit.coEmbeds7 captured connections
embedstreams.top → www.primecinemaapp.comEmbeds4 captured connections
foxtrend.st → adexchangerapid.comCalls1 captured connections
foxtrend.st → chat.21aims.shopEmbeds1 captured connections
foxtrend.st → embedstreams.topEmbeds1 captured connections
foxtrend.st → usrpubtrk.comCalls1 captured connections
foxtrend.st → www.blockadsnot.comLoads from1 captured connections
tcliktrc.online → grabpopdownloadnowtoday.monsterRedirects to1 captured connections
www.gamerhit.co → t.tenlets.comRedirects to7 captured connections
www.primecinemaapp.com → fonts.googleapis.comLoads from1 captured connections
www.primecinemaapp.com → www.google.comCalls1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

20:16:26.342 GET 200 document 13.4 KB 86 ms —

20:16:26.669 GET 200 stylesheet 20.1 KB 18 ms —

20:16:26.673 GET 200 img 1.7 KB 17 ms —

20:16:26.953 GET No response script 0 B 0 ms —

20:16:26.962 GET 200 subdocument 973 B 237 ms 2 alerts

20:16:26.967 GET 200 subdocument 2.1 KB 242 ms —

20:16:26.968 GET 200 script 607.2 KB 56 ms —

20:16:27.136 GET 200 img 1.1 KB 17 ms —

20:16:27.324 GET 200 script 203.3 KB 35 ms —

20:16:27.327 GET 200 script 512.8 KB 126 ms —

20:16:27.331 GET 200 script 24.9 KB 24 ms —

20:16:27.334 GET 200 script 498.1 KB 234 ms 2 alerts

20:16:27.335 GET 200 stylesheet 6.3 KB 123 ms —

20:16:27.337 GET 200 stylesheet 2.5 KB 163 ms —

20:16:27.341 GET 200 script 152.2 KB 335 ms —

20:16:27.343 GET 200 script 7.4 KB 167 ms —

20:16:27.484 GET 200 fetch 1.0 KB 267 ms 3 alerts

20:16:27.495 POST 204 beacon 0 B 193 ms 3 alerts

20:16:27.540 GET 200 font 31.4 KB 83 ms —

20:16:27.541 GET 200 font 31.4 KB 78 ms —

20:16:27.543 GET 200 font 31.4 KB 75 ms —

20:16:27.644 POST 202 xhr 2 B 58 ms 2 alerts

20:16:27.659 GET 200 script 339.1 KB 154 ms 2 alerts

Transaction #38

Request / response

URL

GET HTTPS

https://embedstreams.top/js/wasm/lock.js

IP / ASN

81.17.16.194

AS51852 · Private Layer INC

Requested by: https://embedstreams.top/embed-noads/admin/ppv-portugal-vs-nigeria/1

Resource information

File type: Unicode text, UTF-8 text, with very long lines (28694), with NEL line terminators
MIME type: text/javascript; charset=utf-8
First seen (UTC): 10 Jun 2026 · 19:37:46.404 UTC
Last seen (UTC): 18 Sep 2026 · 00:11:53.117 UTC
Times seen: 51

Size: 339.1 KB (347230 bytes)
MD5: 4b174e3a81a2356f5e5faf4354884549
SHA1: 2ba6539ccae501aec26b864e3e71928049add817
SHA256: e391c3e6567c3e89759d347f4f80dfc0c4f83088b3eeb187c61859dbad743c75

Certificate information

Issuer: Let's Encrypt · YE2
Subject: embedstreams.top
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 77:E2:D8:16:0D:9D:BD:89:0D:AB:61:BE:19:3E:E6:09:D8:D4:DB:9B
Valid from: Sat, 06 Jun 2026 00:32:32 GMT
Valid until: Fri, 04 Sep 2026 00:32:31 GMT

Technology fingerprints

No technology fingerprints recorded for this response.

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Hagezi Threat Feed Sinkholed	medium	Malicious
Quad9 DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /js/wasm/lock.js HTTP/1.1
Host: embedstreams.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://embedstreams.top/js/bundle-jw.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Date: Wed, 10 Jun 2026 14:04:36 GMT
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: goat
Last-Modified: Sun, 07 Jun 2026 05:55:05 GMT
Cache-Control: public, max-age=604800, immutable
Content-Encoding: gzip
Vary: Accept-Encoding
Accept-Ranges: bytes
Content-Length: 74877
Connection: keep-alive

20:16:27.662 GET 200 subdocument 2.2 KB 455 ms 2 alerts

20:16:27.748 GET 101 websocket 0 B 137 ms —

20:16:27.924 GET 200 fetch 180.9 KB 131 ms 2 alerts

20:16:28.085 POST 200 fetch 263 B 60 ms 2 alerts

20:16:28.136 GET 200 subdocument 395 B 206 ms —

20:16:28.142 GET 200 subdocument 297 B 453 ms —

20:16:28.145 GET 200 subdocument 358 B 439 ms —

20:16:28.152 GET 200 subdocument 298 B 443 ms —

20:16:28.160 GET 200 subdocument 298 B 426 ms —

20:16:28.165 GET 200 subdocument 298 B 423 ms —

20:16:28.174 GET 200 subdocument 395 B 352 ms —

20:16:28.176 GET 200 subdocument 395 B 279 ms —

20:16:28.178 GET 200 subdocument 393 B 355 ms —

20:16:28.180 GET 200 subdocument 393 B 334 ms —

20:16:28.182 GET 200 subdocument 398 B 459 ms —

20:16:28.183 GET 200 subdocument 398 B 277 ms —

20:16:28.187 GET 200 fetch 239 B 125 ms —

20:16:28.440 GET 302 subdocument 0 B 0 ms —

20:16:28.454 GET 200 script 329.9 KB 125 ms 2 alerts

20:16:28.456 GET 200 script 563.0 KB 213 ms 2 alerts

20:16:28.487 GET 302 subdocument 0 B 40 ms —

20:16:28.491 GET 302 subdocument 0 B 37 ms —

20:16:28.550 GET 302 subdocument 0 B 0 ms —

20:16:28.556 GET 200 subdocument 1.4 KB 187 ms —

20:16:28.557 GET 200 subdocument 1.4 KB 166 ms —

20:16:28.560 GET 200 subdocument 0 B 0 ms —

20:16:28.570 GET 302 subdocument 0 B 0 ms —

http://foxtrend.st/event/ppv-portugal-vs-nigeria/admin/1

Domain graph

Hostnames

Connections

Network requests

Transaction #38

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://foxtrend.st/event/ppv-portugal-vs-nigeria/admin/1

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #38

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://foxtrend.st/event/ppv-portugal-vs-nigeria/admin/1

Domain graph

Network requests