| |  18.197.238.135 | 200 OK | 83 kB |
URL User Request GET HTTP/1.1IP18.197.238.135:80
File typeHTML document, ASCII text, with very long lines (22177) Hash89bf191f4c3b33450b607fb065aed9f8 0fa0bd184fa6c26ea60bc620db974df9ddf41ff9 34025b038d8d19a0ac0f7a79f7a27a78ce7e5add6ab4d5d2fbc86b21d872af5f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; path=/
Link: <http://18.197.238.135/wp-json/>; rel="https://api.w.org/", <http://18.197.238.135/wp-json/wp/v2/pages/774>; rel="alternate"; type="application/json", <http://18.197.238.135/>; rel=shortlink
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/styles/burger-menu-styles.min.css?ver=1.8.2 | 18.197.238.135 | 200 OK | 2.8 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/styles/burger-menu-styles.min.css?ver=1.8.2 IP18.197.238.135:80
File typeASCII text, with very long lines (20974), with no line terminators Hashe52950ac84c9c7d996ebe1950d81f411 e6e7eb6844b9293fc607f1948ee16c5743f14ee1 5edde5c3db75707581b2815cfcc708b28fe19dec60f3c8b14475787c230ed255
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/styles/burger-menu-styles.min.css?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-51ee"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| ajax.googleapis.com/ajax/libs/jqueryui/1.13.2/themes/smoothness/jquery-ui.css?ver=6.5.3 |  142.250.74.42 | 200 OK | 8.4 kB |
URL GET HTTP/1.1ajax.googleapis.com/ajax/libs/jqueryui/1.13.2/themes/smoothness/jquery-ui.css?ver=6.5.3 IP142.250.74.42:80
File typeASCII text, with very long lines (2363) Hash3c2da607f80184551f63b34ec1333f7a e6bb00a0ea07daa01a9537fe66a448f77af8ab56 8473ed670b978405cb4ef7a6822385043b30107e0dae82a008326c6ed237ce51
GET /ajax/libs/jqueryui/1.13.2/themes/smoothness/jquery-ui.css?ver=6.5.3 HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 8444
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 17 May 2024 07:36:00 GMT
Expires: Sat, 17 May 2025 07:36:00 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Last-Modified: Wed, 20 Jul 2022 08:22:53 GMT
Content-Type: text/css; charset=UTF-8
Vary: Accept-Encoding
Age: 101936
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/ui/theme.css?ver=1.11.29 | 18.197.238.135 | 200 OK | 1.5 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/ui/theme.css?ver=1.11.29 IP18.197.238.135:80
Hash63383024484edf6045048aff18725402 ac20211bc35c79a70a4bc414dd0dd8ea0378978c 9efae4f7df6595cefd5d6fadfd1501e929a9ae0a0f50acde73221cae691e0486
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/ui/theme.css?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-148d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/ui/account.css?ver=1.11.29 | 18.197.238.135 | 200 OK | 771 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/ui/account.css?ver=1.11.29 IP18.197.238.135:80
Hash819e8744934568c4f46c181dc810a33b 3959910e605370edd54e2e8a2443b7a1cfd6bc16 6a6b58da797ea9bd80d9d16320a70074386adf51c2d537624e70597be8e273bd
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/ui/account.css?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-938"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/magnific-popup.min.css?ver=6.5.3 |  104.17.24.14 | 200 OK | 1.3 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/magnific-popup.min.css?ver=6.5.3 IP104.17.24.14:443
CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeASCII text, with very long lines (5259), with no line terminators Hash64912a79884a20761ab19de42f85218c 8d29cea8f84afdcaa69c0594e37263f7374dc8a6 3d92e113ac3031b838001ddddf965d045f470ff748ff2e116b30378910eeaecb
GET /ajax/libs/magnific-popup.js/1.1.0/magnific-popup.min.css?ver=6.5.3 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 18 May 2024 11:54:56 GMT
content-type: text/css; charset=utf-8
content-length: 1283
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ed4-148b"
last-modified: Mon, 04 May 2020 16:12:04 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 143531
expires: Thu, 08 May 2025 11:54:56 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GM6rPGmVWPjxGlhLs1vUXFB%2FOhCV%2Bm0VXGiKxEb%2F6sK5K6i9%2FsoIw3%2BQ5GPq9cWVGGfh47BOVJfH%2Bb6lk1srtH96sVDZ4OQYqZ3ugfY8NElbH7xLiGZ8KNEjxU7NRTylzYx40dYg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 885ba7ca186d568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/ui/login.css?ver=1.11.29 | 18.197.238.135 | 200 OK | 289 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/ui/login.css?ver=1.11.29 IP18.197.238.135:80
Hashb0725b6958824a0a31d68488e25503b8 be79de90f265f35fd838817ccc78f38dce420d20 50e1903c2bdd8a9e4b02b36bc80e232fd8cae17a8424bdb210ec394756c97936
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/ui/login.css?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-35e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/jquery-ui-timepicker-addon.css?ver=6.5.3 | 18.197.238.135 | 200 OK | 559 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/jquery-ui-timepicker-addon.css?ver=6.5.3 IP18.197.238.135:80
Hash8628a9abb0f79db1096df06b7117008c e68fde2d4340ca5150d55e3158a68e47844f6d93 badead68a89608a47efad49693b4ce97e28f20c4bb668cc865509a758369387e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/jquery-ui-timepicker-addon.css?ver=6.5.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-797"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/styles/style.min.css?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 7.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/styles/style.min.css?ver=3.2.1.3 IP18.197.238.135:80
File typeASCII text, with very long lines (37420), with no line terminators Hashd1e92ffe7e18f064ef60ba96c67d562f 07f9105ce7467da2461a596ebdd0f361e7993b09 e8e271d1b031e3053bdf00b248648d3f53598b1add8c7e8992892499da568c09
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/styles/style.min.css?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-922c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js?ver=6.5.3 | 104.17.24.14 | 200 OK | 6.5 kB |
URL GET HTTP/2cdnjs.cloudflare.com/ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js?ver=6.5.3 IP104.17.24.14:443
CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (20087) Hashba6cf724c8bb1cf5b084e79ff230626e f455c5f153f872e52265f87a644ff89fe14a6fb6 3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4
GET /ajax/libs/magnific-popup.js/1.1.0/jquery.magnific-popup.min.js?ver=6.5.3 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Sat, 18 May 2024 11:54:56 GMT
content-type: application/javascript; charset=utf-8
content-length: 6546
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ed4-4ef8"
last-modified: Mon, 04 May 2020 16:12:04 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 67572
expires: Thu, 08 May 2025 11:54:56 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WBuMjlt%2BXAvq11t50jXIKeXfzMpEqX9y25J0dE3QrbAWRTLqefkyam%2FYxtoZlQpkI3qhxjcMPRzfgYlqGPTAidh5Xz%2BlhIklBbaZ1q0O5kU%2FhtRJ4jma9t9%2FaMH2Ogv6DP27CxBg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 885ba7ca2882568f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Open+Sans%3A400%2C700&ver=1.3.12 | 142.250.74.106 | 200 OK | 1.6 kB |
URL GET HTTP/1.1fonts.googleapis.com/css?family=Open+Sans%3A400%2C700&ver=1.3.12 IP142.250.74.106:80
File typeASCII text, with very long lines (1572) Hash20bd411dd6647a5c0a91cdef809c8214 39955f7a9b151b067af8d34792cb913e1071f366 73ab184ce53f45b7c89518dbddebf61c280683bcb3239ab421ead85e827cbb03
GET /css?family=Open+Sans%3A400%2C700&ver=1.3.12 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
Expires: Sat, 18 May 2024 11:54:56 GMT
Date: Sat, 18 May 2024 11:54:56 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/signup.css?ver=1.11.29 | 18.197.238.135 | 200 OK | 1.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/signup.css?ver=1.11.29 IP18.197.238.135:80
Hash3bcceaa0bb64f0a1a0e32360653cdc34 8a00c065a2943651011dd574e27aa57e03812fc1 24898754d6a591a01902e242a74202410a9522459b58e7c2737ee7d7651b14c5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/signup.css?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-1485"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/css/plans.min.css?ver=1.11.29 | 18.197.238.135 | 200 OK | 3.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/css/plans.min.css?ver=1.11.29 IP18.197.238.135:80
File typeASCII text, with very long lines (30665) Hash6ddfb299b2012d86c1ec92c9c2919b72 2114a6dfe4da0a06c9fee45d051bfec26c089cfe 50159cdebcc2b4e38fe2cba5a1fb20e0cb21a7bc11d23ba6d72ac43cace11996
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/css/plans.min.css?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-77ca"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/css/dashicons.min.css?ver=6.5.3 | 18.197.238.135 | 200 OK | 37 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/css/dashicons.min.css?ver=6.5.3 IP18.197.238.135:80
File typeASCII text, with very long lines (58981) Hashd68d6bf519169d86e155bad0bed833f8 27ba9c67d0e775fc4e6dd62011daf4c3902698fc c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/css/dashicons.min.css?ver=6.5.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:56 GMT
Content-Type: text/css
Last-Modified: Tue, 06 Feb 2024 15:22:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e99-e688"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/css/divi-mobile-stop-stacking.min.css?ver=6.5.3 | 18.197.238.135 | 200 OK | 1.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/css/divi-mobile-stop-stacking.min.css?ver=6.5.3 IP18.197.238.135:80
File typeASCII text, with CRLF line terminators Hash599ebde7b5329375305ab338fbe82d4d 2e734f55848105d7fb7c1d91c28b2de63c27f5dd 03621317ecd3414051ec7fb7503eb337d53ca62002909b21677ce5c06dd446b8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/css/divi-mobile-stop-stacking.min.css?ver=6.5.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-419f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1714984973 | 18.197.238.135 | 200 OK | 760 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1714984973 IP18.197.238.135:80
File typeASCII text, with very long lines (2782), with no line terminators Hash78b10b5ab3274275e3ad29a5182c5053 67f4e3e6619d2a1aac209876d35e1eb74ef703b2 0d5f949fcf84560d013b596b51856d6bc487bedc510bc712e82458f00b2506e5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css?ver=1714984973 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Mon, 06 May 2024 08:42:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6638980d-ade"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.10 | 18.197.238.135 | 200 OK | 10 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.10 IP18.197.238.135:80
File typeASCII text, with very long lines (18820) Hash4940e4ae72b6124a6eab7e97fc8df1f4 20986cbb9965f176b6c6ccf1adefcf783f9e9e9a 58c855e7eb9b917e71e6b733e73c542c25bacb986f3ba7df2be1570200312135
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.10 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Tue, 09 Apr 2024 09:35:49 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66150bf5-e768"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/styles/expand-shape/circle-expand.min.css?ver=1.8.2 | 18.197.238.135 | 200 OK | 842 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/styles/expand-shape/circle-expand.min.css?ver=1.8.2 IP18.197.238.135:80
File typeASCII text, with very long lines (3676) Hash14344bd5d0bfe6512eea60b6dc07f6d8 26d9eab609be50153e2092b6084d1bc920d30886 81abe12eb06182fde1e7776ec4c59ff4f86a5a2ebc2d33595b8b5cc8e45d3a42
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/styles/expand-shape/circle-expand.min.css?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-e5d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/styles/frontend-general.min.css?ver=1.8.2 | 18.197.238.135 | 200 OK | 939 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/styles/frontend-general.min.css?ver=1.8.2 IP18.197.238.135:80
File typeASCII text, with very long lines (2479) Hashab466ccfc2b7937b825e1a0691b30894 361eae44fc9de3b84639d98380012db4529a6373 fbf55541bcaaec9d406edc0e8a8f53f5f5abec960f0e8be6d7e20921f456a30a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/styles/frontend-general.min.css?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-9b0"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/monarch/css/style.css?ver=1.4.14 | 18.197.238.135 | 200 OK | 16 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/monarch/css/style.css?ver=1.4.14 IP18.197.238.135:80
File typeUnicode text, UTF-8 text, with very long lines (718) Hashda967565cb2fce059a631f0f90adf079 138db4815bcbfab11d16d800ecd5bda5d8666e9b f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/monarch/css/style.css?ver=1.4.14 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 14:01:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1956-1c56d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/styles/bottom-navigation/icons.css?ver=1.8.2 | 18.197.238.135 | 200 OK | 3.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/styles/bottom-navigation/icons.css?ver=1.8.2 IP18.197.238.135:80
File typeUnicode text, UTF-8 text, with very long lines (28121), with CRLF line terminators Hashf0b04339db009df193af32663fbaf2d4 d678dbbf22a275a833da9322e5afcfdf7f96c359 0688c6312f9642fc42da0ad59a0b4d96084d4dacefe2c811fa4037cd7b852c8b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/styles/bottom-navigation/icons.css?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-6ddd"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/styles/style.min.css?ver=1.0.0 | 18.197.238.135 | 200 OK | 530 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/styles/style.min.css?ver=1.0.0 IP18.197.238.135:80
File typeASCII text, with CRLF line terminators Hash3761eabf8707bfde31c6e1c92fb44f2f bdad87f2e4f590d682227c4c738fd32a32272ae6 42fef3ae4e264fc7e846de3207c9728370d396afb9136cd2a77a2bbcef40f9a4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/styles/style.min.css?ver=1.0.0 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-4e8"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine-account/styles/style.min.css?ver=1.1.1 | 18.197.238.135 | 200 OK | 617 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine-account/styles/style.min.css?ver=1.1.1 IP18.197.238.135:80
File typeASCII text, with very long lines (1565), with no line terminators Hash9644b164e31a3a28e77d2b1e0a5548cf d354dc5bbc54936e1ba42182914a8bc387d2c105 f81fde23356204f3c9bef52eed1ad175bc183cd32a836098ccc214c4added267
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine-account/styles/style.min.css?ver=1.1.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:52:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce170f-61d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/styles/style.min.css?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 6.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/styles/style.min.css?ver=6.1.6.1 IP18.197.238.135:80
File typeASCII text, with CRLF line terminators Hash464d3c9f7a1ddbe44d379d82cbc9d909 913d979b5cf755f1f3259c0d8008f12e8bb579a4 7272fa7d23b4a2bd615955c97a356223d1f0c0f628055a1386d4bd07854a42c9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/styles/style.min.css?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:54:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1779-7898"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-ajax-filter/styles/style.min.css?ver=3.1.7.3 | 18.197.238.135 | 200 OK | 26 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-ajax-filter/styles/style.min.css?ver=3.1.7.3 IP18.197.238.135:80
File typeUnicode text, UTF-8 text, with very long lines (65535), with no line terminators Hashd01314a5841670ad1900c77a7e484468 08b4333510bb9431ad3c47f9bf5815573e216f4b 751a73d9a95700a13e0592a06cfa3680c9a50f8105bcc1332b4ed0b92dc78ca2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-ajax-filter/styles/style.min.css?ver=3.1.7.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Tue, 14 May 2024 16:58:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66439840-25f4a"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 2.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.97.4 IP18.197.238.135:80
File typeASCII text, with very long lines (6470), with no line terminators Hash9389a240ec2d748902e2f3d837d46912 8c5e52769ff791c2751cde97d2f59b2b11d095d3 ca3af915877e0f119ce0df14dfce6249f76222c600e23882fa7c7f99788971cc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/css/magnific_popup.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-1946"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 4.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.97.4 IP18.197.238.135:80
File typeASCII text, with very long lines (1470) Hash6a1155513ed86ffe7387373c1c3228dd 49ed8d65cbe5601656d9f0e06c0a8eb0a65019ec c1b94e225b989e86f8b6c589c0778c17ec25d2465f33fd10dc7e2e45f060fa6c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/css/swiper.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-5865"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 1.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.97.4 IP18.197.238.135:80
File typeASCII text, with very long lines (5001), with no line terminators Hashde3e0625d50bcb2e7b8c552585307bc0 68e4453126243cdcd4d843f6208d0125987c0a11 2f1e0ba0f1a9560f8d67fb010c58f8995fa681625c321e18133ccec0043bce47
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/css/popup.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-1389"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 6.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.97.4 IP18.197.238.135:80
Hashf733d0fb45713b13b3ef2e60abf101ba abc1c8bf1d48d261bf40ad9e86598b684a18a49c 2414767fbf3e93d3269cb3795b6c667da0f58a8f662dfd8aabb0807243d1134f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/css/animate.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-14d7b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| essentialoilsbible.eu/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 |  46.250.220.133 | 200 OK | 3.1 kB |
URL GET HTTP/2essentialoilsbible.eu/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 IP46.250.220.133:443
CertificateIssuerLet's Encrypt Subjectessentialoilsbible.eu Fingerprint31:85:F0:E7:E7:E9:BF:3C:F9:E4:B7:CA:C6:FA:1B:2D:DE:32:13:FF ValidityFri, 17 May 2024 19:40:00 GMT - Thu, 15 Aug 2024 19:39:59 GMT
File typeHTML document, ASCII text, with very long lines (2036), with CRLF, LF line terminators Hash923fea37882dd70c5a6dcabfac04988d 3f483a7009b7698fa28ee3d274df36d369c39c85 5dae04dea691ac7361d4fc8918753ee8b631867ee031260393f6081b52e01f6d
GET /wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 HTTP/1.1
Host: essentialoilsbible.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
content-length: 3145
date: Sat, 18 May 2024 11:54:57 GMT
server: LiteSpeed
x-qc-pop: EU-NO-SVG-73
location: https://essentialoilsbible.eu/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 49 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.97.4 IP18.197.238.135:80
File typeASCII text, with very long lines (35603) Hash918a0ac13f4fc7824cdec43f175ea0b5 6f9a2ec0ca2c3fdb418d11a283640c983d344aec 9268379e0ead7490e2eefb34cd5c8b86294b5239e3f31baa3be5a382905b5d8e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/styles/style.min.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-69878"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/css/carousel.min.css?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 1.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/css/carousel.min.css?ver=6.1.6.1 IP18.197.238.135:80
File typeUnicode text, UTF-8 text, with very long lines (3439), with no line terminators Hash4271256eb7d7382fd1255cf5121dca9a 65acbeff36ac98d07a0c012973ace2ca3f5b4d7d 18077e40e233fcda47ac0394fa97e56320f3a2525e809d6091960e58d3d5c6d6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/css/carousel.min.css?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 13:54:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1778-d85"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 626 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.97.4 IP18.197.238.135:80
Hashbbd61e5da0b9dd8b9718dd37a9582c3f cff350a63740a5a5eb17958f451c81b80b28aa1e 009e58f3632270c3fa8d127a9e132807a0920ac00512a2a0c5f3e8d5d728d373
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/css/readmore.css?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-6bd"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 | 18.197.238.135 | 200 OK | 34 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (65447) Hash826eb77e86b02ab7724fe3d0141ff87c 79cd3587d565afe290076a8d36c31c305a573d18 cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-15601"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 | 18.197.238.135 | 200 OK | 5.2 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (13479) Hash9ffeb32e2d9efbf8f70caabded242267 3ad0c10e501ac2a9bfa18f9cd7e700219b378738 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-3509"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.10 | 18.197.238.135 | 200 OK | 179 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.10 IP18.197.238.135:80
Hashc6a55456af4776c733018888483aba22 297b53f8538ba3b59d2028f16de4e14ec90337ce 20be9b3c63a01d921697a0ef1c1596f647678498eefe6dc508e2363be25277f8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.10 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 09 Apr 2024 09:35:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66150bf4-10f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1 | 18.197.238.135 | 200 OK | 102 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1 IP18.197.238.135:80
File typeASCII text, with very long lines (65192) Size102 kB (102418 bytes) Hash628eadd35a2d9ab4ea4ff359cb44c1f2 27916ecd2bbcd879bf2456161c42ac8c4080aac2 9a2c16c49fc5c97da8c6dddc06b0d31af0fa1c5c2ca9dac592027039f1de82ef
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/style-static.min.css?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-c957b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/underscore.min.js?ver=1.13.4 | 18.197.238.135 | 200 OK | 7.9 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/underscore.min.js?ver=1.13.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (18798) Hashf88d5720bb454ed5d204cbdb56901f6b f1952292fde4b15936e9aac16b2b9896684db95b 726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/underscore.min.js?ver=1.13.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-4991"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2 | 18.197.238.135 | 200 OK | 2.7 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (8171), with no line terminators Hashdda652db133fddb9b80a05c6d1b5c540 60c8514c57a5db2980c4b046b0dd479bd427357b c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-1feb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0 | 18.197.238.135 | 200 OK | 2.7 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (6625), with no line terminators Hashfd7ef2e4737acd74fd0dcdc3b515e304 0d792b33f12a48ee8aaaf2560a63a5682470645b 1d52e1ac7d3bc25a8b0ffc257153f9dd50249f96fe9a4df5e0d771241a69062c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.14.0 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-19e1"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 | 18.197.238.135 | 200 OK | 15 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 IP18.197.238.135:80
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (38582), with no line terminators Hash92f8c01350c630f414f5d0b015ad6864 eab40ab4e77f92f2fb17684aaf44b579a51b8034 17b79ece7ef9d1454a90156690d33d64387b67a7a7548fc826012512e287a937
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Wed, 03 Apr 2024 09:02:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"660d1b19-96be"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 | 18.197.238.135 | 200 OK | 1.6 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (4272) Hash072d3f6e5c446f57d5c544f9931860e2 ee6aa3d65b474309376468b24bb6f829a4514809 2cb546fbdda7995d374fffa4b2f6530bbcf57d014639ddf76de45df43d593045
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/hooks.min.js?ver=2810c76e705dd1a53b18 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Wed, 03 Apr 2024 09:02:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"660d1b19-10d3"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 | 18.197.238.135 | 200 OK | 3.9 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 IP18.197.238.135:80
Hasha8127c1a87bb4f99edbeec7c37311dcd 9997a1745f48bdd233dbe9bd8164daa53eba105b f313d12ea6124bd28fc4a6b7163d253bb83d5aeab5edce594880c5c3df475cbc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/i18n.min.js?ver=5e580eb46a90c2b997e6 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Wed, 03 Apr 2024 09:02:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"660d1b19-23b5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/login.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 533 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/login.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hasha6dc3f0ca3f057d3677efc800447ba3d 5f040e0ce4f321bbfd92b2a5e2a252cac1ce6517 60df1ff455b5cfa08c030a0e20c65f58c5e925e397d33ab4dc687dfccc27168a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/login.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-4da"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/jquery.payment.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 4.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/jquery.payment.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (386) Hashac1edf0d87bd3996da56beccbf7df1ef 89e2c2079359d19fe65c2592ae23ecfd92dc8584 178c565a08a17fa7ab2fe84f122bec98a668c17f8aa95e2f3915a4cef26ed003
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/jquery.payment.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-43f7"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2 | 18.197.238.135 | 200 OK | 7.8 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/jquery/ui/core.min.js?ver=1.13.2 IP18.197.238.135:80
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (8189) Hashc4e68a0f3463c0bd3c39eab38815e881 0ce58644e9f3c5063a11453ff287c5ec096465a7 ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-53be"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/validate.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 1.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/validate.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash142aaf5c592c8106d7bb6c73031be1fa 4f573ebec6339b1c07a6c8a07f146188a0ce0452 d8058ad3876d8a0a891598cbf3c800f8b2ea3753a5146abfd4bde9434ca8a31c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/validate.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-bdc"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/i18n.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 1.8 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/i18n.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash3d19a3a6127373b7c0a72b049ee47fa5 806e14b2c9fc07cf29b0b61c7dc74807f5941376 cf721c27d775bd9c51ba6990d050acfabf8908aeaa595042ab46653093063d31
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/i18n.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-15e5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.2 | 18.197.238.135 | 200 OK | 12 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (36546) Hash5c15bd4af856f6d6b583064ca537a0c1 2fa6972cd70e64bd573058de292e4d451995b93b db5ffd916dbeb4938cc236cb3a42e73a56987f28c5deb9f3beccbe2c4af19307
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/jquery/ui/datepicker.min.js?ver=1.13.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e98-8f79"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/jquery-ui-timepicker-addon.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 23 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/jquery-ui-timepicker-addon.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash04c2a3e935b141cc9cc0142b5c9aa412 159023bb726cae3ddbf126a185545136cea6beb2 0b9293fcdb3ec24a1d7226355c9e33194cb80084e7d210db01249b6d26007a32
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/jquery-ui-timepicker-addon.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-15000"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/date_picker.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 693 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/date_picker.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash81c1672243119527a7b195ee8751ba2f fa870aff23a4375185f576969ee5fb11385befa3 abbed3fe0bb0b4fd50f9138b704ad8f2a38a9609ada3ae2ed3698b8860f2a300
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/date_picker.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-69d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/memberpress/js/signup.js?ver=1.11.29 | 18.197.238.135 | 200 OK | 5.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/memberpress/js/signup.js?ver=1.11.29 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash0dd052a4e1f21f7f4d05369d4e50ca18 18d19422d85a93f65f8e45704a474482d7e24429 410fad7f49df9026fcd7f6dd245c96c9b417143f8e0c97e3c24006ec6a7f3cae
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/memberpress/js/signup.js?ver=1.11.29 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 09 May 2024 23:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663d570d-4e55"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/includes/modules/divi-ajax-filter/js/masonry.min.js?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 433 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/includes/modules/divi-ajax-filter/js/masonry.min.js?ver=6.1.6.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (831), with no line terminators Hash7fa53d0c765c778fd55518487bd89b17 2c3af04c190c8b41c9449b1f2cb97d27a203e85e 00466f6b4d2e9854b230054b961ccaea573e2d245c6b0a64d96bd85cbec56618
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/includes/modules/divi-ajax-filter/js/masonry.min.js?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:54:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1779-33f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/js/modernizr.2.8.3.js?ver=1.8.2 | 18.197.238.135 | 200 OK | 4.7 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/js/modernizr.2.8.3.js?ver=1.8.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (10910) Hash411b35fc5f7f38c3821e6c9fa9aa0fe9 055ea7169e848f3679088d191d4ea4732cf1d04c f132d313baf0fca207bc9c51733d9510160ec43a68b54c8986a578366832d576
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/js/modernizr.2.8.3.js?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-2a9f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/if-so/public/js/if-so-public.js?ver=1.8.0.2 | 18.197.238.135 | 200 OK | 3.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/if-so/public/js/if-so-public.js?ver=1.8.0.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash7887b171ba6060c78e81f870a41546c3 1a5dd8e4ecabe009bbe64aa4e47a5cf934ef315e bc138ff85c0a6c860b5177ae20e5fa286d9c2ba4a100043f93ca5f1edbf84c8f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/if-so/public/js/if-so-public.js?ver=1.8.0.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Wed, 03 Apr 2024 10:14:23 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"660d2bff-2e17"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/ifso-bulks-extenstion/js/ifso-bulks-public.js?ver=6.5.3 | 18.197.238.135 | 200 OK | 1.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/ifso-bulks-extenstion/js/ifso-bulks-public.js?ver=6.5.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash552c212577647dcd86061e5d191c9fb2 bc813382427258afe35194e152e135df1d103614 3846f1f9437fc5896507549b093dfc7f7ccaa2379c3796abff9dfc0b3b861b7a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/ifso-bulks-extenstion/js/ifso-bulks-public.js?ver=6.5.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Fri, 03 May 2024 16:02:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66350ab3-ef9"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-ajax-filter/js/divi-filter-loadmore.min.js?ver=3.1.7.3 | 18.197.238.135 | 200 OK | 2.7 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-ajax-filter/js/divi-filter-loadmore.min.js?ver=3.1.7.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (8519), with no line terminators Hashe8a53a179c63251b42b751d9b35b4176 7394210ba2dca9ade93f19d33d46df90cfcf0a63 3fecac074476b2081f0fdff03d66d02072029542362e7b6f7265c86c0d29c50b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-ajax-filter/js/divi-filter-loadmore.min.js?ver=3.1.7.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 14 May 2024 16:58:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66439840-2147"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/js/divi-form-ai.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 751 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/js/divi-form-ai.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (1736), with no line terminators Hashba6de95090490eace197e2d64d83ac73 995e6776f0368ad7159217edc4f06835f08e96cb 459d56b9e893f0167d1fbb0bb92120c445c4006e7cb87a0a49ee382a1ed34ab6
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/js/divi-form-ai.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-6c8"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/js/multistep-admin.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 338 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/js/multistep-admin.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (572), with no line terminators Hash0e3cc9130d7f4399fbc8cef40d61b703 a747c123dc9529084133ee2df7e2b94cbe2a5bcb 1a75c197f907cb50a4324727f0add17ca0cd909116226af1e4c3049748184abb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/js/multistep-admin.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-23c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/bloom/css/style.css?ver=1.3.12 | 18.197.238.135 | 200 OK | 14 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/bloom/css/style.css?ver=1.3.12 IP18.197.238.135:80
File typeASCII text, with very long lines (847) Hashedc56fc35ef9730a59ae79b7ee2d1e45 a1c2a1a42b940fc09465f2eed2ce3d6d151dd1d9 846190311422b8501d25e7fa82a6f03640979882b59b875da0c038877bd15151
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/bloom/css/style.css?ver=1.3.12 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: text/css
Last-Modified: Thu, 15 Feb 2024 14:02:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce196b-1756f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/js/classie.js?ver=1.8.2 | 18.197.238.135 | 200 OK | 382 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/js/classie.js?ver=1.8.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (784) Hash80a2a2e91f2d1f346e195b4ef795d8f0 170a506d0ffb98b674f8b3644bc64228270fb371 95c783eafaa333d075a583bc5a204b15d3a79bf2caa9d953ca956072d237c2fc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/js/classie.js?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-311"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/js/velocity.min.js?ver=1.8.2 | 18.197.238.135 | 200 OK | 13 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/js/velocity.min.js?ver=1.8.2 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (32191), with CRLF line terminators Hash51c6c258bb124409561872bf9b6b483e c29ae7d06da7b6498dfd89a939f0b9e44fe2ef09 092fa5badf4d217cf179f04eb2ce4c7c7eaaf77eabd6f1ba934daa865116dcfe
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/js/velocity.min.js?ver=1.8.2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-8628"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/monarch/js/idle-timer.min.js?ver=1.4.14 | 18.197.238.135 | 200 OK | 1.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/monarch/js/idle-timer.min.js?ver=1.4.14 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (2516) Hash4a92000ffde74f28c7a5f7c7a6d139a6 0841cdbc84da7396bb1c817a697dd524bfb32a19 80fa756dda143f69fb3ce750e905cc8188150dc4c6b7539bf3627fe26530b405
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/monarch/js/idle-timer.min.js?ver=1.4.14 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 14:01:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1956-a4b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/monarch/js/custom.js?ver=1.4.14 | 18.197.238.135 | 200 OK | 6.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/monarch/js/custom.js?ver=1.4.14 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (351) Hashe707ec1abd4ca9c8fd45bd6fdd4b4224 086db688c9c66f930e166e59c4d6ec3eee90449f 43b5c9ad80f0a5d1c63568583e9cf6cd5ca8454a680f4ee80d5d63d00b15a360
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/monarch/js/custom.js?ver=1.4.14 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 14:01:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1956-6855"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/js/smoothscroll.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 2.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/js/smoothscroll.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (5644) Hashb6a40b8c22e5dd0e51404ac7aa45710a 823e4b015387a2714f826a7f386a0f6698c4b6e2 75079f39fe739015589a0f995f41b4c1c29d4ebac85c93a792926af09f61cc83
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/js/smoothscroll.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43d-1652"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 1.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hashfa07f10043b891dacdb82f26fd2b42bc 9c1dc49e9747758e033c0e9a7d016401bd78602c 462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-d15"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/js/scripts.min.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 82 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/js/scripts.min.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (65467) Hashb0e961ecc4f382beaf59cf3e10a97a33 c6f773ce0359ec130d7ac93a1da4b070ec8d4ebd 1d5b19f81ae284a59aee36257fc8b157c4f48a99ef5692b038adb56ec48d09bb
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/js/scripts.min.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43d-42f9b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-includes/js/comment-reply.min.js?ver=6.5.3 | 18.197.238.135 | 200 OK | 1.4 kB |
URL GET HTTP/1.118.197.238.135/wp-includes/js/comment-reply.min.js?ver=6.5.3 IP18.197.238.135:80
File typeASCII text, with very long lines (2946) Hash492f2c1a7ea7eb83fe42e0ff7cb51aa2 db36a77f6aaa2063bfbec02c2c0e967438c5a245 e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/comment-reply.min.js?ver=6.5.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 06 Feb 2024 15:22:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65c24e99-ba5"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.mobile.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 3.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.mobile.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (7584) Hash984977dc184f8059f2a679b324893e4c d60a246ba584ba892a87bcf446e71d26adbcb91a 55a084b5f4c439a2786141108b266370e0e4accc4e72629b2177dc6aa658d6c8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.mobile.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-1f18"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 9.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (21184) Hashb709961dd29d261ee0ce8fb17101874a 9a286eaaa964091528b256c81bb446c7072b7e19 0a47c6e6f24e634cb79f886e70bbfd65e1e85b0d2aa4fc133488fd1bc1910e3e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/magnific-popup.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-5902"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 3.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (6322) Hashbf7fe805ab945e4b2c4d56da59476811 307135fd2987f477c7bd50fcd0cc28a1cff1f568 b6205029e1016596807b655c8f57818736a787e32ceb1407effa152ac3bb9380
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/salvattore.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-217e"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 3.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash00346ced8d8b5c664b826381bdcd7c48 1cb0ab506f3892db432c81ab6982fe6837004d23 5aa24e4ab926693e29ffb0d0ca1557141defd3ca61b3b4e7caebaa2fcd5bf327
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/easypiechart.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-2466"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-ajax-filter/scripts/frontend-bundle.min.js?ver=3.1.7.3 | 18.197.238.135 | 200 OK | 334 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-ajax-filter/scripts/frontend-bundle.min.js?ver=3.1.7.3 IP18.197.238.135:80
File typeASCII text, with very long lines (699), with no line terminators Hash16af57fd160cf85a7cf4502da31054ae 006db42d30a9f42530bfc0f996afb6804df3a26e 05c86a01cec19a9f9931163c42515adaab424be687667ef09f7d9b3cd0765cb5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-ajax-filter/scripts/frontend-bundle.min.js?ver=3.1.7.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Tue, 14 May 2024 16:58:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66439840-2bb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/scripts/frontend-bundle.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 333 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/scripts/frontend-bundle.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (632), with no line terminators Hashfaab5398b1b75f5066d04bcdddbf3800 3975cf1252be6fb6b0a56f8954fb46cf4826ccbf 7be8905d140b26c8cd0cc0b6797ee0347007c8849834d12860f434ac1a221175
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/scripts/frontend-bundle.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-278"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine-account/scripts/frontend-bundle.min.js?ver=1.1.1 | 18.197.238.135 | 200 OK | 335 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine-account/scripts/frontend-bundle.min.js?ver=1.1.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (652), with no line terminators Hashe74bc0c03a1562df35bc5cc000f02f7b 87357aeb241cd2616928d68b39dd306c70714efb 8045e2ca3dcac2a61f73ad940ea9aacc3dc707e2c9797821c5d565e92228a76e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine-account/scripts/frontend-bundle.min.js?ver=1.1.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:52:15 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce170f-28c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/scripts/frontend-bundle.min.js?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 315 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/scripts/frontend-bundle.min.js?ver=6.1.6.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (541), with no line terminators Hash507181d12e7f3732f88939e76ffb7072 2b95ea2ea75dfd93e11537cf5a6509e13307134a 1f65bcf7a5c0f61624cf2c7c5323e06903dfda959d2cc3533085d31a8537da89
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/scripts/frontend-bundle.min.js?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:54:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1779-21d"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-mobile/scripts/frontend-bundle.min.js?ver=1.0.0 | 18.197.238.135 | 200 OK | 324 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-mobile/scripts/frontend-bundle.min.js?ver=1.0.0 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (586), with no line terminators Hash7019aad48dad424359b006cee2db680b 13cbdf254b9bfe1182e53916c392c984154e33fe 0dbb2162a089a403b2daee61b753d2e8bb08de8423979187dedf624b6bcb7737
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-mobile/scripts/frontend-bundle.min.js?ver=1.0.0 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:56:26 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce180a-24a"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/js/common.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 587 B |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/js/common.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hashd71b75b2327258b1d01d50590c1f67ca b7820e4ffb6becc133c48f66d9f683545530b959 1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/js/common.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43d-53f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/js/frontend-general.min.js?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 4.8 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/js/frontend-general.min.js?ver=6.1.6.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (18507), with no line terminators Hash796c4133acecb9d3b3c6ae8dca8362f5 6f50eaaf1f55965529620107b8a22bf0581c06a3 e6902ef76e08c7a20100bc9c57ae7fac78bbb8908fcc3f994ccee507323609f8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/js/frontend-general.min.js?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:54:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1779-484b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-machine/js/carousel.min.js?ver=6.1.6.1 | 18.197.238.135 | 200 OK | 12 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-machine/js/carousel.min.js?ver=6.1.6.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (32026), with CRLF line terminators Hash563ea0519c5a1b8f47865fe532aca7fa d48b3bcd9bb85affb3b3416a84857700190c58f9 509b04a1616d8265e79f5cadfc1444b6d07e779c12a822b742f746040f4f6b71
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-machine/js/carousel.min.js?ver=6.1.6.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:54:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce1779-a9e7"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1714984973 | 18.197.238.135 | 200 OK | 12 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1714984973 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (40430), with no line terminators Hash684ba0b36cb26363cf696e27eac0cf08 574ee20736ef0f3093d9565658ff453cea82113a e48afa0ca2fdaed77ef3d14202f805ab16829b42e321b71635d538f9e9efa4e2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js?ver=1714984973 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Mon, 06 May 2024 08:42:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6638980d-9dee"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/CardCarousel/frontend.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 1.7 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/CardCarousel/frontend.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (4606), with no line terminators Hash4de7dc4a907773e17b3c6ce5b1a62a8a de41f4fe90caa02b6c8b313ef2b38fc5d0c6e431 f8087e19e738fb142cd8b503e83081b0caf513b884f52a4eecb86ec5cd657361
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/CardCarousel/frontend.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-11fe"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/popper.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 7.9 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/popper.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (20006) Hash25a41197a57da5decf8ed8d12947dac8 6033b9ffd1ac0a64aba77571cd55e681dbae2b99 051a8137b75880006ab58f47778ca713ed6c967130faba043c5cd0ed34517dc8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/js/popper.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-4e7f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/tippy-bundle.umd.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 9.5 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/tippy-bundle.umd.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (25667) Hashbe40939a1df8aa4cec53fb6ae572df26 189159143337e0bc08ce30b8b8a59a5e935335fe 3f0fe70eb26ccf28f6887a192e29d38dd7ef7c2f079a73304ad42ddc7bed37de
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/js/tippy-bundle.umd.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-6475"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/ImageHotSpots/frontend.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 668 B |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/ImageHotSpots/frontend.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (1458), with no line terminators Hash0596eebdd67cbcbf90d5cc9d69c2ef52 abe6abfa4c2429feab18598f21fa5ef0743332b2 4ef70d84911718dcefb46dbb3b8c7132a4b2e32d76034f8b7fa868550757e2e4
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/includes/modules/ImageHotSpots/frontend.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-5b2"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/js/divi-form-builder.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 3.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/js/divi-form-builder.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (9552), with no line terminators Hashe33a2c9fdfcd193f987b92f2689b46e5 37ae342089402652a57f8921b121c858993ff306 5bde3712090489fafba75f8803a617bb5e5bf66d02039ac54841b0eb85c4a477
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/js/divi-form-builder.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-2550"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/swiper-bundle.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 45 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/public/js/swiper-bundle.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (65284) Hashadf4d8a8269c6de5a15e081e838d47a0 f64bdee46be3b38377cc333baa08b5d091cd878e 568c3ba372e075ecceb821409f5d45be311c896c3c784910eb5f2f20e5c90670
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/public/js/swiper-bundle.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-239c1"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/extensions/Popup/frontend.min.js?ver=4.9.97.4 | 18.197.238.135 | 200 OK | 2.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/supreme-modules-pro-for-divi/includes/extensions/Popup/frontend.min.js?ver=4.9.97.4 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (7136), with no line terminators Hashf9f8028ef9e203de53841a342cd0fa1e 6e98b180b7dc4bded082a4e9641a38d05901bf1b 9e904639c833ebe382e31ab6c9dbf616e463365b21b7fcdcb2235bcfa543699e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/supreme-modules-pro-for-divi/includes/extensions/Popup/frontend.min.js?ver=4.9.97.4 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 06:45:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663f1401-1be0"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/bloom/js/custom.js?ver=1.3.12 | 18.197.238.135 | 200 OK | 7.9 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/bloom/js/custom.js?ver=1.3.12 IP18.197.238.135:80
File typeJavaScript source, ASCII text Hash7051c071eff3b0075c38aaded01dc4b1 d49c5ebbbaf8e474d2b611685f14e34d55610c3a 279f6b481748c18d498dd5ad4cb01aee8aaab9fe2845094491f2632d4b99b686
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/bloom/js/custom.js?ver=1.3.12 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 14:02:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce196b-7187"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/js/jquery.validation/jquery.validate.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 16 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/js/jquery.validation/jquery.validate.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (582), with CRLF line terminators Hash4398f4b198fc55b165715e3faa4ebce0 7f4e3f0f919d1e97fa927fa01ae3919094bac0c1 e6aa9be55c50dadd9ae99c7f9de5b9ba9a4b2ef6869f89e7d0d758a7a83c2f28
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/js/jquery.validation/jquery.validate.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-ce5f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/bloom/js/jquery.uniform.min.js?ver=1.3.12 | 18.197.238.135 | 200 OK | 3.2 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/bloom/js/jquery.uniform.min.js?ver=1.3.12 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (8308), with no line terminators Hash2842654782a75cbbc8cd66c60b72631d ef3a49fe1bcf31cca95cdee5563928a850a1b154 8a41d60f7762f2db0792fd909c3c09725f93d8fe1e94efcb2ca04293921e277a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/bloom/js/jquery.uniform.min.js?ver=1.3.12 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 14:02:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce196b-2074"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/divi-form-builder/js/jquery.validation/additional-methods.min.js?ver=3.2.1.3 | 18.197.238.135 | 200 OK | 7.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/divi-form-builder/js/jquery.validation/additional-methods.min.js?ver=3.2.1.3 IP18.197.238.135:80
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (22029), with CRLF line terminators Hash8a9f80d26adfcc24829e8f1ca8b457b8 2b90bcca46a672da71a6d42b1b8ec92fbc6c3fe0 375d48c89a474e00dc4826f701f5f856b067a4641e7a6d4da0dcf381c5d5c827
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/divi-form-builder/js/jquery.validation/additional-methods.min.js?ver=3.2.1.3 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 13:57:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce185b-56a1"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/plugins/bloom/js/idle-timer.min.js?ver=1.3.12 | 18.197.238.135 | 200 OK | 1.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/bloom/js/idle-timer.min.js?ver=1.3.12 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (2400) Hash8f926e1b4f59dc0bc15efa760dbb0dfe f01d4974ea5634db13d0c7ece05c48fede04dba0 92c35f839d90ea55730d05ce3ea859cb598cd85eb20be3ed55621bb8baa3aa36
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/bloom/js/idle-timer.min.js?ver=1.3.12 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Feb 2024 14:02:19 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"65ce196b-9d6"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 46 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash01db529f22a258e905ba7b5a31eb218f 1cdf0a4a508c3645b5db10d4b0ffc076540e2386 21299aa0cfccae6adfc1fdc2d6dfd6895c47f6f8b714b2683df914f9b5b485a3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/motion-effects.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-26902"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| 18.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/sticky-elements.js?ver=4.25.1 | 18.197.238.135 | 200 OK | 67 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/sticky-elements.js?ver=4.25.1 IP18.197.238.135:80
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashaeec463b37d075ea9b5ed5cd4ea88fa7 314facfb70bdceb0f42467de7cb0603a3884dc52 e133ed1ae38d54fc651a16b69201398f49452e7b207f7a49a3773706f1e17648
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/sticky-elements.js?ver=4.25.1 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:57 GMT
Content-Type: application/javascript
Last-Modified: Sat, 11 May 2024 20:25:34 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"663fd43e-33098"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| essentialoilsbible.eu/wp-content/uploads/2024/02/Logo.svg | 46.250.220.133 | 200 OK | 3.1 kB |
URL GET HTTP/3essentialoilsbible.eu/wp-content/uploads/2024/02/Logo.svg IP46.250.220.133:443
CertificateIssuerLet's Encrypt Subjectessentialoilsbible.eu Fingerprint31:85:F0:E7:E7:E9:BF:3C:F9:E4:B7:CA:C6:FA:1B:2D:DE:32:13:FF ValidityFri, 17 May 2024 19:40:00 GMT - Thu, 15 Aug 2024 19:39:59 GMT
File typeHTML document, ASCII text, with very long lines (2036), with CRLF, LF line terminators Hash923fea37882dd70c5a6dcabfac04988d 3f483a7009b7698fa28ee3d274df36d369c39c85 5dae04dea691ac7361d4fc8918753ee8b631867ee031260393f6081b52e01f6d
GET /wp-content/uploads/2024/02/Logo.svg HTTP/1.1
Host: essentialoilsbible.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html
content-length: 3145
date: Sat, 18 May 2024 11:54:58 GMT
server: LiteSpeed
x-qc-pop: EU-NO-SVG-73
location: https://essentialoilsbible.eu/wp-content/uploads/2024/02/Logo.svg
|
|
| 18.197.238.135/wp-content/uploads/2024/02/thomas-lefebvre-gp8BLyaTaA0-unsplash.jpg | 18.197.238.135 | 200 OK | 29 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/thomas-lefebvre-gp8BLyaTaA0-unsplash.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 640x427, components 3 Hash5afffaa0f6ad1343a4d4df239d32c790 dcab67d1db5864bc2193295212057d2db3a7479e cef386382af9d994cd8c194b9ac343b2da4a41f80d3fb7ef5e88d155436625fc
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/thomas-lefebvre-gp8BLyaTaA0-unsplash.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 28870
Last-Modified: Thu, 29 Feb 2024 10:48:49 GMT
Connection: keep-alive
ETag: "65e06111-70c6"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/Essential-Oil.jpg | 18.197.238.135 | 200 OK | 29 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/Essential-Oil.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 640x427, components 3 Hash6c8ec3f0da081258e92d6bc09a54fe2c 7489348cb5023f65a9cd8777f2e4204d05c48ac7 4896a7fa7d2626a7a1367e0bd01a5a53077c69e930470a1d4c4002b0aaaaca85
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/Essential-Oil.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 28621
Last-Modified: Tue, 20 Feb 2024 21:08:46 GMT
Connection: keep-alive
ETag: "65d514de-6fcd"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/peter-conlan-LEgwEaBVGMo-unsplash.jpg | 18.197.238.135 | 200 OK | 89 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/peter-conlan-LEgwEaBVGMo-unsplash.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 640x427, components 3 Hashc95044c649d3216d723f065752d08899 f0949dba3c97eaf84cbac460df8d1949bec3d112 d9d9cb38f3913642d86e0b3f9df425716db5bdb464719c15520d28b536a3f438
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/peter-conlan-LEgwEaBVGMo-unsplash.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 88727
Last-Modified: Thu, 29 Feb 2024 11:00:05 GMT
Connection: keep-alive
ETag: "65e063b5-15a97"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/Body_Map_square.png | 18.197.238.135 | 200 OK | 174 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/Body_Map_square.png IP18.197.238.135:80
File typePNG image data, 600 x 600, 8-bit/color RGBA, non-interlaced Size174 kB (173771 bytes) Hash893c8cd49c60ca9f0d18895e1a1fa1f3 bcd2bdd4ceb4289b11c33fc3430591d82c6245c1 4bc55f3aeaea81f56d52bb692f3ff5becbf3f618a1772afc9536a1eb4943ad22
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/Body_Map_square.png HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/png
Content-Length: 173771
Last-Modified: Tue, 27 Feb 2024 16:00:18 GMT
Connection: keep-alive
ETag: "65de0712-2a6cb"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/thumbs-up-4589867_640.jpg | 18.197.238.135 | 200 OK | 33 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/thumbs-up-4589867_640.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x427, components 3 Hashb707ade58e45b627595217dac5a5dd04 d44bc4fbfbc8587039ab32df880162dca7fe842e 7584b748aa0c57a8cce3acd9e40149f5d4d7317f7db47c8a5a5f4a8fba9090ec
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/thumbs-up-4589867_640.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 33051
Last-Modified: Thu, 29 Feb 2024 10:47:15 GMT
Connection: keep-alive
ETag: "65e060b3-811b"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/how_It_Works_Img_b8a8549dbb.png | 18.197.238.135 | 200 OK | 78 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/how_It_Works_Img_b8a8549dbb.png IP18.197.238.135:80
File typePNG image data, 453 x 511, 8-bit/color RGBA, non-interlaced Hash8751f3248570e70407a4055dcdd268e6 6fe886a4cab6924b6660fb7566b4b72aed0fb0cc 9e898adc11ff190737049ed7861db2bc36fcc34a7e68314d925ab7795c7ef4b1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/how_It_Works_Img_b8a8549dbb.png HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/png
Content-Length: 78218
Last-Modified: Sat, 24 Feb 2024 07:45:21 GMT
Connection: keep-alive
ETag: "65d99e91-1318a"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/bath-balls-3006585_1280.jpg | 18.197.238.135 | 200 OK | 225 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/bath-balls-3006585_1280.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x855, components 3 Size225 kB (225041 bytes) Hash7320f5a993c479c0f9c24177d21dbd14 0e6dd05907600b73540a449cd6cd890e570b3b0e edd9da1babe03bdb85d40983aa6265a46e8b72c1ffa80bf4a3d0266bbf028042
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/bath-balls-3006585_1280.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 225041
Last-Modified: Tue, 27 Feb 2024 22:28:55 GMT
Connection: keep-alive
ETag: "65de6227-36f11"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/Body_Map_3ku2.png | 18.197.238.135 | 200 OK | 281 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/Body_Map_3ku2.png IP18.197.238.135:80
File typePNG image data, 900 x 600, 8-bit/color RGBA, non-interlaced Size281 kB (280852 bytes) Hash013aeb6caa2479cead541351a459d5a8 0ca7745c2d45b3157b19d1f4e1c7bcfd6d554409 ae4e17c9c32db2ec57374d649fced10c30f6d4678521502c7f6bd242a2c20c2a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/Body_Map_3ku2.png HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/png
Content-Length: 280852
Last-Modified: Thu, 29 Feb 2024 11:03:28 GMT
Connection: keep-alive
ETag: "65e06480-44914"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/ailment-1280x854.jpg | 18.197.238.135 | 200 OK | 69 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/ailment-1280x854.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x854, components 3 Hash7e9bbff2cba417ef03c7a1f8b1452972 1f3b74e9f269e3bbbb5dc158df31d18c8236ce79 c5e63d17464b7f1a0c2a7519aa88f3e07ea82cf5f775ca60e1293882dc2e9f7e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/ailment-1280x854.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 69064
Last-Modified: Tue, 27 Feb 2024 22:21:04 GMT
Connection: keep-alive
ETag: "65de6050-10dc8"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/eye-5248678_640.jpg | 18.197.238.135 | 200 OK | 51 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/eye-5248678_640.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x427, components 3 Hash7bd43d78f6b5722a3f41505e1e3eed0f 2fdeeb8d535eb2910956660ca6955a8f521b97cc 7ef49d992a1214b98eca168da94f0285a527ca3c832150bf715825807aaea11a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/eye-5248678_640.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 50736
Last-Modified: Thu, 29 Feb 2024 11:00:24 GMT
Connection: keep-alive
ETag: "65e063c8-c630"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/flags/sk.svg | 18.197.238.135 | 200 OK | 1.6 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/flags/sk.svg IP18.197.238.135:80
File typeSVG Scalable Vector Graphics image Hash6ed3cf547a2f8579e45330fde3095537 dfc6023844bb5a110c3d9219c82dd326940ae055 c1b338efd99956c2ae0c62fcf559b2d956fa11f71751985d62c9942b061dad6a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/sitepress-multilingual-cms/res/flags/sk.svg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/svg+xml
Content-Length: 1637
Last-Modified: Tue, 09 Apr 2024 09:35:48 GMT
Connection: keep-alive
ETag: "66150bf4-665"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/Logo.svg | 18.197.238.135 | 200 OK | 8.0 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/Logo.svg IP18.197.238.135:80
File typeSVG Scalable Vector Graphics image Hashe0b7b6b09bb80ff4a3b0126268797699 24ccfa403a81257aa0d41ff2ac919d7383fbb6d8 c4747b303bb20a5bb1c22775a7062406e9257ebde28e22ff003a6ba5173cb738
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/Logo.svg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/svg+xml
Content-Length: 8035
Last-Modified: Tue, 27 Feb 2024 14:19:01 GMT
Connection: keep-alive
ETag: "65ddef55-1f63"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/pregnant-775036_640.jpg | 18.197.238.135 | 200 OK | 50 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/pregnant-775036_640.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x425, components 3 Hashb8001bf12ae824cf091d31c645186186 597a9b9fe998c986eb427c9b8945147b8eb7f4ce 7ef70dc9e7aebd00b482a3b8d88d4c8d99e9870fc47f5889fbec35c9908aa90a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/pregnant-775036_640.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 50440
Last-Modified: Thu, 29 Feb 2024 11:08:36 GMT
Connection: keep-alive
ETag: "65e065b4-c508"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/flags/en.svg | 18.197.238.135 | 200 OK | 1.3 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/sitepress-multilingual-cms/res/flags/en.svg IP18.197.238.135:80
File typeSVG Scalable Vector Graphics image Hashcf165af749d574a25a1a29f31b0ed692 fd1663941236e3105b46f020e0e23913452b2585 4c5edc0c143fffe3bfed4126d2b3527e6e21c57499af43f9577b45c6eb93e598
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/sitepress-multilingual-cms/res/flags/en.svg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/svg+xml
Content-Length: 1290
Last-Modified: Tue, 09 Apr 2024 09:35:48 GMT
Connection: keep-alive
ETag: "66150bf4-50a"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/hero_Img_Home_26e1e441f1.png | 18.197.238.135 | 200 OK | 708 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/hero_Img_Home_26e1e441f1.png IP18.197.238.135:80
File typePNG image data, 939 x 905, 8-bit/color RGBA, non-interlaced Size708 kB (707841 bytes) Hashfa1c73f88e2b6829a880a1e24f9ed651 a56d93dba92b0097f566613d3ab67ab82e1ed181 a0cb41476bc23e9199e553b16a348c35ad12d0e9a93d8b54a4a013c12e865b86
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/hero_Img_Home_26e1e441f1.png HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/png
Content-Length: 707841
Last-Modified: Tue, 27 Feb 2024 13:58:40 GMT
Connection: keep-alive
ETag: "65ddea90-acd01"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/section_img_1_d8ec9c3af9-1280x854.jpg | 18.197.238.135 | 200 OK | 84 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/section_img_1_d8ec9c3af9-1280x854.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x854, components 3 Hash49a190f4f0318c849cbfb4b899347825 0fce3e73c5f4e12ca0a471fecb773a1870c9da7b 899788c5d9f5b4863f249d9b7498c7b1c3aa00ef580d1db8ab8956838a0c68d5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/section_img_1_d8ec9c3af9-1280x854.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/jpeg
Content-Length: 83792
Last-Modified: Thu, 29 Feb 2024 10:48:36 GMT
Connection: keep-alive
ETag: "65e06104-14750"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/Change-your-life.png | 18.197.238.135 | 200 OK | 1.1 MB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/Change-your-life.png IP18.197.238.135:80
File typePNG image data, 1075 x 717, 8-bit/color RGBA, non-interlaced Size1.1 MB (1113919 bytes) Hash374370b22f7663facae9ffb3a7050aa1 9f3f7b605348b5e737eb44ba20da908189c250b3 b009d93f678ec9b943d76fa8d8ea861b2e2927bfad88db1bbf65da1de83a9e5d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/Change-your-life.png HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: image/png
Content-Length: 1113919
Last-Modified: Thu, 29 Feb 2024 11:06:09 GMT
Connection: keep-alive
ETag: "65e06521-10ff3f"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| essentialoilsbible.eu/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 | 46.250.220.133 | 200 OK | 48 kB |
URL GET HTTP/2essentialoilsbible.eu/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 IP46.250.220.133:443
CertificateIssuerLet's Encrypt Subjectessentialoilsbible.eu Fingerprint31:85:F0:E7:E7:E9:BF:3C:F9:E4:B7:CA:C6:FA:1B:2D:DE:32:13:FF ValidityFri, 17 May 2024 19:40:00 GMT - Thu, 15 Aug 2024 19:39:59 GMT
File typegzip compressed data, from Unix Hasha4943d72ef539ee5ccbf07494a8a089f cece52c29fef338660d6053738c4189fd11f6512 088d0403f37c9f70113d23cb0fa93b8cefcfe98e44d1cf6e27e8b240d4015258
GET /wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 HTTP/1.1
Host: essentialoilsbible.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://18.197.238.135/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Sat, 25 May 2024 11:54:58 GMT
etag: "102-6643074d-443da;gz"
last-modified: Tue, 14 May 2024 06:40:13 GMT
content-type: text/css
accept-ranges: bytes
vary: Accept-Encoding
x-litespeed-tag: de6_,5177717_CSS
x-qc-cache: miss
content-encoding: gzip
date: Sat, 18 May 2024 11:54:58 GMT
server: LiteSpeed
x-qc-pop: EU-NO-SVG-73
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff | 18.197.238.135 | 200 OK | 92 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff IP18.197.238.135:80
File typeWeb Open Font Format, TrueType, length 92084, version 2.4 Hash4f7c51948ce1b802a13ebbccec151d0c 5b1d3cd0929108da4b6334c4a487db08c9520f1d fe67b77ac7e0ef4b482dafb86adfa403db1b89a2f337d2dc8bd1278cfe975196
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: font/woff
Content-Length: 92084
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Connection: keep-alive
ETag: "663fd43d-167b4"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff | 18.197.238.135 | 200 OK | 92 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff IP18.197.238.135:80
File typeWeb Open Font Format, TrueType, length 92084, version 2.4 Hash4f7c51948ce1b802a13ebbccec151d0c 5b1d3cd0929108da4b6334c4a487db08c9520f1d fe67b77ac7e0ef4b482dafb86adfa403db1b89a2f337d2dc8bd1278cfe975196
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/fonts/modules/all/modules.woff HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: font/woff
Content-Length: 92084
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Connection: keep-alive
ETag: "663fd43d-167b4"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/plugins/monarch/css/fonts/monarch.ttf | 18.197.238.135 | 200 OK | 15 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/monarch/css/fonts/monarch.ttf IP18.197.238.135:80
File typeTrueType Font data, 11 tables, 1st "OS/2", 14 names, Macintosh, type 1 string, monarch Hash402ae848e7488fbc1da63531f327066a ba1fd4d145958f3d2d86587cb134ef5a590cb50a 8c102baea959329be23bb8a5d6bc268ce1668484995f0d23c2f88b46d7653c4f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/monarch/css/fonts/monarch.ttf HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/plugins/monarch/css/style.css?ver=1.4.14
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:58 GMT
Content-Type: application/octet-stream
Content-Length: 15096
Last-Modified: Thu, 15 Feb 2024 14:01:58 GMT
Connection: keep-alive
ETag: "65ce1956-3af8"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_DjQbMhhLw.woff2 | 216.58.207.227 | 200 OK | 18 kB |
URL GET HTTP/2fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_DjQbMhhLw.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 18252, version 1.0 Hashfe39da0b4f919df33f2968cd70958c0d c778676aefbfc0eeae371d0b4349a621a6a9c853 70d75e3a90a34a48aa69596dc8a364c09876c04ae34ccf8faa8cefac8e763e92
GET /s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_DjQbMhhLw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18252
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 May 2024 17:46:26 GMT
expires: Fri, 16 May 2025 17:46:26 GMT
cache-control: public, max-age=31536000
age: 151712
last-modified: Thu, 24 Aug 2023 20:46:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ArQbMhhLw.woff2 | 216.58.207.227 | 200 OK | 18 kB |
URL GET HTTP/2fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ArQbMhhLw.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 18068, version 1.0 Hash12ec4d8f5d565966b9d30bdc8f57cf43 e8f1761fc784333f62683574b20854c2d7cdedc2 338a94525c776acdd0251c1f9b02bc6e18c3dacd021b6665dd41bda5cc28c2b3
GET /s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ArQbMhhLw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18068
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 17 May 2024 16:31:41 GMT
expires: Sat, 17 May 2025 16:31:41 GMT
cache-control: public, max-age=31536000
age: 69797
last-modified: Thu, 24 Aug 2023 20:46:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_GbQbMhhLw.woff2 | 216.58.207.227 | 200 OK | 18 kB |
URL GET HTTP/2fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_GbQbMhhLw.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 17864, version 1.0 Hashf7d4cf6227b4871d3a90459cd5c91e4f 474e750f7bf4a14a8d30f0087197f78115a8bcdb e0838b642e822ce327a0daa24109a7aecec831876c660b345f875f0a49e39aab
GET /s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_GbQbMhhLw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17864
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 May 2024 04:56:15 GMT
expires: Fri, 16 May 2025 04:56:15 GMT
cache-control: public, max-age=31536000
age: 197923
last-modified: Thu, 24 Aug 2023 20:46:43 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_N_XbMhhLw.woff2 | 216.58.207.227 | 200 OK | 18 kB |
URL GET HTTP/2fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_N_XbMhhLw.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 17600, version 1.0 Hash8a7eed3acaebaaa199675665e8451e7d 5886fafbabc297d0f9ecd26c5ddbc004d1d22a16 d08ea0afc9b2474178a7048f12405305f3a6f8ec7c6cc84e6b62234026d933f6
GET /s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_N_XbMhhLw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 17600
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 17 May 2024 16:33:19 GMT
expires: Sat, 17 May 2025 16:33:19 GMT
cache-control: public, max-age=31536000
age: 69699
last-modified: Thu, 24 Aug 2023 20:46:36 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| essentialoilsbible.eu/wp-content/uploads/2024/02/Logo.svg | 46.250.220.133 | 200 OK | 3.9 kB |
URL GET HTTP/3essentialoilsbible.eu/wp-content/uploads/2024/02/Logo.svg IP46.250.220.133:443
CertificateIssuerLet's Encrypt Subjectessentialoilsbible.eu Fingerprint31:85:F0:E7:E7:E9:BF:3C:F9:E4:B7:CA:C6:FA:1B:2D:DE:32:13:FF ValidityFri, 17 May 2024 19:40:00 GMT - Thu, 15 Aug 2024 19:39:59 GMT
File typeSVG Scalable Vector Graphics image Hashe0b7b6b09bb80ff4a3b0126268797699 24ccfa403a81257aa0d41ff2ac919d7383fbb6d8 c4747b303bb20a5bb1c22775a7062406e9257ebde28e22ff003a6ba5173cb738
GET /wp-content/uploads/2024/02/Logo.svg HTTP/1.1
Host: essentialoilsbible.eu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://18.197.238.135/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Sat, 25 May 2024 11:54:58 GMT
etag: "1f63-664306c8-49bc2;br"
last-modified: Tue, 14 May 2024 06:38:00 GMT
content-type: image/svg+xml
accept-ranges: bytes
vary: Accept-Encoding
x-qc-cache: miss
content-length: 3882
content-encoding: br
date: Sat, 18 May 2024 11:54:59 GMT
server: LiteSpeed
x-qc-pop: EU-NO-SVG-73
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
|
|
| 18.197.238.135/wp-content/uploads/complianz/css/banner-1-optin.css?v=34 | 18.197.238.135 | 200 OK | 3.4 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/complianz/css/banner-1-optin.css?v=34 IP18.197.238.135:80
File typeASCII text, with very long lines (15560), with no line terminators Hashbe8735fe76aaec2d463ac21b6ead7879 89cf19a7989b15fd2d81dacd50f5abcf4652675c e3d594b13bbdbac3f13cde9fb02cbbebff55ac81e82ff425d79f1c13a4a9187a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/complianz/css/banner-1-optin.css?v=34 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: text/css
Last-Modified: Mon, 13 May 2024 11:16:17 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"6641f681-3cc8"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
|
|
| fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ObXbMhhLw.woff2 | 216.58.207.227 | 200 OK | 18 kB |
URL GET HTTP/2fonts.gstatic.com/s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ObXbMhhLw.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 18100, version 1.0 Hash9883a1d12ae33a483048b4f903e1e667 72498798445874b3207eeee5f216e3e9e99e286b 00f8a248da79c87958596445f155f6f1c76ccfc8cf7cf336901ee85de783b50e
GET /s/josefinsans/v32/Qw3PZQNVED7rKGKxtqIqX5E-AVSJrOCfjY46_ObXbMhhLw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18100
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 17 May 2024 00:00:11 GMT
expires: Sat, 17 May 2025 00:00:11 GMT
cache-control: public, max-age=31536000
age: 129288
last-modified: Thu, 24 Aug 2023 20:46:45 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-brands-400.woff2 | 18.197.238.135 | 200 OK | 78 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-brands-400.woff2 IP18.197.238.135:80
File typeWeb Open Font Format (Version 2), TrueType, length 78460, version 331.-31392 Hashf075c50f89795e4cdb4d45b51f1a6800 f726c4275bb494a045fde059175f072de06c01df 71b3ce72680f4183d28db86b184542051fd533bb1146933233e4f6a20cf98cba
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-brands-400.woff2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: font/woff2
Content-Length: 78460
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Connection: keep-alive
ETag: "663fd43d-1327c"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-solid-900.woff2 | 18.197.238.135 | 200 OK | 80 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-solid-900.woff2 IP18.197.238.135:80
File typeWeb Open Font Format (Version 2), TrueType, length 80300, version 331.-31392 Hash8e1ed89b6ccb8ce41faf5cb672677105 9b592048b9062b00f0b2dd782d70a95b7dc69b83 6b555920e358f8a25a422988b448615c33bcccb4f932e8331cebfc8e2a737fc7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-solid-900.woff2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: font/woff2
Content-Length: 80300
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Connection: keep-alive
ETag: "663fd43d-139ac"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2 | 216.58.207.227 | 200 OK | 26 kB |
URL GET HTTP/2fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 25500, version 1.0 Hash02ac191f58314f4c044700cc49f544c0 ac8fc920e3b31ab2e4f58dbb4fbc7329efdbc936 8189eb6330e9f0b62e4fe2be8bbad8129ebf1db97e390c2386e0b5a2880aa403
GET /s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-NYiFWUU1.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 25500
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 13 May 2024 10:54:45 GMT
expires: Tue, 13 May 2025 10:54:45 GMT
cache-control: public, max-age=31536000
age: 435614
last-modified: Thu, 29 Jun 2023 16:13:30 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2 | 216.58.207.227 | 200 OK | 25 kB |
URL GET HTTP/3fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2 IP216.58.207.227:443
CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com FingerprintE4:8A:04:4E:A9:40:14:A5:25:38:29:DB:90:36:5A:67:AE:85:31:6C ValidityMon, 06 May 2024 14:43:26 GMT - Mon, 29 Jul 2024 14:43:25 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 25320, version 1.0 Hash00350b741e6792d88386a79d5ae11e0e 88d4eda6b25d2e30b5f0cc338f7a50e62442e19d fbf0d9704506b1ad0def13dc96bf24602d807afe597a754ae59fe1d2c0efcec4
GET /s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFWUU1.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 25320
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 16 May 2024 08:25:48 GMT
expires: Fri, 16 May 2025 08:25:48 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 29 Jun 2023 16:18:09 GMT
content-type: font/woff2
age: 185351
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| 18.197.238.135/wp-content/uploads/2024/02/cropped-Logo-na-icon-192x192.jpg | 18.197.238.135 | 200 OK | 10 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/cropped-Logo-na-icon-192x192.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [
- TIFF image data, big-endian, direntries=2], baseline, precision 8, 192x192, components 3 Hashe0eb7eacf7b4617ede72723223f0cc2a 1d21e47e59cafafdebfdf8cb315ffb91fdc49f64 f68dba494e6da7804b7f596f45e4adf8f8643932971d047b7ba70b889c62f859
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/cropped-Logo-na-icon-192x192.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; wp-wpml_current_language=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: image/jpeg
Content-Length: 10364
Last-Modified: Thu, 15 Feb 2024 14:30:42 GMT
Connection: keep-alive
ETag: "65ce2012-287c"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/uploads/2024/02/cropped-Logo-na-icon-32x32.jpg | 18.197.238.135 | 200 OK | 2.1 kB |
URL GET HTTP/1.118.197.238.135/wp-content/uploads/2024/02/cropped-Logo-na-icon-32x32.jpg IP18.197.238.135:80
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [
- TIFF image data, big-endian, direntries=2], baseline, precision 8, 32x32, components 3 Hash67c7a675a8f4c686a5d0497cf06553eb 76913a5001b134b336733ef5d0336bb368caa794 37c73dbbc87eefc1f373f993cef28ff534c118971aa39e4edfa0e96d0d9e8c9e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/2024/02/cropped-Logo-na-icon-32x32.jpg HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; wp-wpml_current_language=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: image/jpeg
Content-Length: 2113
Last-Modified: Thu, 15 Feb 2024 14:30:42 GMT
Connection: keep-alive
ETag: "65ce2012-841"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-regular-400.woff2 | 18.197.238.135 | 200 OK | 14 kB |
URL GET HTTP/1.118.197.238.135/wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-regular-400.woff2 IP18.197.238.135:80
File typeWeb Open Font Format (Version 2), TrueType, length 13548, version 331.-31392 Hash4a74738e7728e93c4394b8604081da62 fb9648469530a05fa9aac80e47d4d6960472a242 ce20ed8a323117c8a718ff1ddc6dabb997373b575a8e896f2bf02b846c082c9d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/themes/Divi/core/admin/fonts/fontawesome/fa-regular-400.woff2 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/themes/Divi/style-static.min.css?ver=4.25.1
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; wp-wpml_current_language=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: font/woff2
Content-Length: 13548
Last-Modified: Sat, 11 May 2024 20:25:33 GMT
Connection: keep-alive
ETag: "663fd43d-34ec"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| 18.197.238.135/wp-content/plugins/bloom/css/fonts/ET-Bloom.woff?gd6mr8 | 18.197.238.135 | 200 OK | 5.9 kB |
URL GET HTTP/1.118.197.238.135/wp-content/plugins/bloom/css/fonts/ET-Bloom.woff?gd6mr8 IP18.197.238.135:80
File typeWeb Open Font Format, TrueType, length 5932, version 2.3 Hash10e1b312c330e1e751215a4849f90d2e 06114f354c1af4c42977700e36ee375572ae64df 89b6fc20e99da6c304c84e47abe126d4f7eb31e5366e97b451a9aca07181ddb3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/plugins/bloom/css/fonts/ET-Bloom.woff?gd6mr8 HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/wp-content/plugins/bloom/css/style.css?ver=1.3.12
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; wp-wpml_current_language=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:54:59 GMT
Content-Type: font/woff
Content-Length: 5932
Last-Modified: Thu, 15 Feb 2024 14:02:19 GMT
Connection: keep-alive
ETag: "65ce196b-172c"
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
|
|
| fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 | 216.58.207.227 | 200 OK | 48 kB |
URL GET HTTP/1.1fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 IP216.58.207.227:80
File typeWeb Open Font Format (Version 2), TrueType, length 48236, version 1.0 Hash015c126a3520c9a8f6a27979d0266e96 2acf956561d44434a6d84204670cf849d3215d5f 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://fonts.googleapis.com/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 48236
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 16 May 2024 02:15:23 GMT
Expires: Fri, 16 May 2025 02:15:23 GMT
Cache-Control: public, max-age=31536000
Age: 207576
Last-Modified: Thu, 14 Dec 2023 02:08:40 GMT
Content-Type: font/woff2
|
|
| 18.197.238.135/wp-admin/admin-ajax.php | 18.197.238.135 | 200 OK | 20 B |
URL POST HTTP/1.118.197.238.135/wp-admin/admin-ajax.php IP18.197.238.135:80
File typegzip compressed data, from Unix Hash7029066c27ac6f5ef18d660d5741979a 46c6643f07aa7f6bfe7118de926b86defc5087c4 59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 18.197.238.135
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 125
Origin: http://18.197.238.135
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Cookie: PHPSESSID=i319edsui4vli3qbeupgcg04o5; wp-wpml_current_language=en
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 18 May 2024 11:55:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: http://18.197.238.135
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: ifso_visit_counts=1; expires=Tue, 13 May 2025 11:55:00 GMT; Max-Age=31104000; path=/
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Encoding: gzip
|
|
| location.services.mozilla.com/v1/country?key=no-mozilla-api-key | 44.241.41.59 | | 48 B |
URL location.services.mozilla.com/v1/country?key=no-mozilla-api-key IP44.241.41.59:0
Hash94bc553225a6cddab963f4053273b388 57ffc8bd333dfe0bf3a05a5945ee15f9c15b0672 977bc9f6239939e6e0a2682325098f1bf0109e1450f040536670acf0f8798cb6
GET /v1/country?key=no-mozilla-api-key HTTP/1.1
Host: location.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Security-Policy: default-src 'none'; report-uri /__cspreport__
Content-Type: application/json
Date: Sat, 18 May 2024 11:55:20 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Length: 48
Connection: keep-alive
|
|
| 54.226.254.247/wp-content/uploads/ailment-scaled.jpg | 0.0.0.0 | | 0 B |
URL GET 54.226.254.247/wp-content/uploads/ailment-scaled.jpg IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-content/uploads/ailment-scaled.jpg HTTP/1.1
Host: 54.226.254.247
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://18.197.238.135/
Pragma: no-cache
Cache-Control: no-cache
|
|