| syndication.exdynsrv.com/splash.php?cat=&idzone=3041612&type=8&p=meetdownload.com/a63911c125bf47b9aaf37d8ff05e7890/waploaded-34368-call-me-by-your-name-2017-mp4&sub=&tags=&el=&cookieconsent=true&scr_info=cmVtb3RlfHBvcHVuZGVyanN8MjkzNzEzOTQ=&tested=2 |  95.211.229.245 | 302 Found | 0 B |
URL User Request GET HTTP/1.1syndication.exdynsrv.com/splash.php?cat=&idzone=3041612&type=8&p=meetdownload.com/a63911c125bf47b9aaf37d8ff05e7890/waploaded-34368-call-me-by-your-name-2017-mp4&sub=&tags=&el=&cookieconsent=true&scr_info=cmVtb3RlfHBvcHVuZGVyanN8MjkzNzEzOTQ=&tested=2 IP95.211.229.245:443 ASN#60781 LeaseWeb Netherlands B.V.
CertificateIssuerLet's Encrypt Subjectexdynsrv.com FingerprintAB:C2:33:20:B1:9C:1A:0F:D5:5C:01:71:6E:65:57:E1:AD:01:C7:86 ValidityMon, 27 Jan 2025 10:44:21 GMT - Sun, 27 Apr 2025 10:44:20 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /splash.php?cat=&idzone=3041612&type=8&p=meetdownload.com/a63911c125bf47b9aaf37d8ff05e7890/waploaded-34368-call-me-by-your-name-2017-mp4&sub=&tags=&el=&cookieconsent=true&scr_info=cmVtb3RlfHBvcHVuZGVyanN8MjkzNzEzOTQ=&tested=2 HTTP/1.1
Host: syndication.exdynsrv.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Fri, 28 Feb 2025 22:52:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: X-CH-VALUES
Set-Cookie: __uvt=a%3A1%3A%7Bi%3A0%3Bs%3A32%3A%22a25a440a9bf22638b24c0174307b464e%22%3B%7D; expires=Sun, 28 Feb 2027 22:52:21 GMT; path=; domain=.exdynsrv.com; Secure; SameSite=none
impressions=xxorxrlbcvxzxmceallcaxzxccevlsabrerovxzxmceallcaxzxccevmeembesovxzxmceallcaozxccevlxssoeravxzxmcemesaclzxccevlxssoeccvxzxmcemesarazxccevlxssoeaevxzxmcemesarazxccevxerrbarxbvszxmcemesarazxccevxecrbbxrcvazxmcemesarmzxccevxxxrrrleovxzxmcemxmcabzxccevbbbocllevxzxmcemxbmmozxccevbbbocllovxzxmcemxbmmozxccevxecaasmxovxzxmcemxbmmszxccevxeobsrombvxzxmcemxbmmszxccevxxorxrlccvozxmcemoxallzxccevxxorxrlcavxzxmcemoxallzxccevlxssoeaovxzxmcemorxsezxccevcxexraervxzxmcemorxsezxccevxxorsaexovxzxmcemorxsezxccevlxssoercvxzxmcemorxsezxccevxxorxaeeevxzxmcemorxsezxccevboomrmsevxzxmcemorxsezxccevlxssoerevxzxmcemsexclzxccevxxorsacsevozxmcemabmsmzxccevxxorsarmcvazxmcemabmsmzxccevxxxlombaevczxmcemabmsmzcbevxxorrbaaavczxmcemabmaczcbevxxebeclaovazxmcemabmaczcbevxxorxrlbovxzxmcemabmaczxccevxxorrbaabvmzxmcemabmaczcbevxxorxrlcovxzxmcemabmarzxccevxxorxrlrbvxzxmcemabmarzxccevxxorxrlbavxzxmcemabmarzxccevxxorxrlmovxzxmcemabmlozxccevxxorxrllevxzxmcemabmlozxccevlsabrercvxzxmcemabmlozxccevxxorxrlrevxzxmcemabmlozxccevxxorxrlcbvxzxmcemaleaszxccevxxorxrlcevxzxmcemaleaszxccevxxorxrlrovozxmcemaleaszxccevxxorxrlaovozxmcemaleaszxccevbrarbbaevxzxmcemaleaszxccevxxorxrlaevozxmcemaleaszxccevxxorxrlrcvxzxmcemaleaszxccevllacrorovozxmcemmeexezxccevxxorxrllovszxmcemmeexmzxccevxerrbaroevxzxmcemmrmsxzxccevxxomeorcevxzxmcemmrbbszxccevxxoaccrxbvxzxmcemmrbbszxccevxxocrcbmovxzxmcemmrbbszxccevxxomeorsbvxzxmcemmrbbczxccevxxoaccrxavxzxmcemmrbbczxccevxxorxrlsovxzxmcemmlecxzxccevbrarbbaovxzxmcemmlecxzxccevlmcoaxsevxzxmcembsxcxzxcce; expires=Sat, 01 Mar 2025 22:52:21 GMT; path=/; domain=.exdynsrv.com; Secure; SameSite=none
Location: https://malakingannets.com/iXHT95hehFLPz9jL1/92707
X-Robots-Tag: noindex, follow
|
|
| malakingannets.com/iXHT95hehFLPz9jL1/92707 | 23.109.170.154 | 200 OK | 5.2 kB |
URL User Request GET HTTP/1.1malakingannets.com/iXHT95hehFLPz9jL1/92707 IP23.109.170.154:443
CertificateIssuerLet's Encrypt Subjectmalakingannets.com FingerprintE1:A5:41:5F:72:3D:1D:A9:FC:3A:4F:E6:EF:BB:07:3E:30:4C:8F:38 ValidityWed, 08 Jan 2025 07:33:24 GMT - Tue, 08 Apr 2025 07:33:23 GMT
File typeHTML document, ASCII text, with very long lines (11773) Hashe5446d022bfb83aa5b6417f81607e5d1 8248c5d720c131e306acc82359c638a0f093484f 804f2e75852f7ce8f27fb15f8d0820b2df4fa7b87d05d8ece6d637514ca61441
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /iXHT95hehFLPz9jL1/92707 HTTP/1.1
Host: malakingannets.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Sat, 01-Mar-2025 22:52:21 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Sat, 01-Mar-2025 22:52:21 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| duomoscrinkum.shop/cuid/?f=https%3A%2F%2Fmalakingannets.com |  188.42.247.220 | 200 OK | 0 B |
URL OPTIONS HTTP/1.1duomoscrinkum.shop/cuid/?f=https%3A%2F%2Fmalakingannets.com IP188.42.247.220:443
Requested byhttps://malakingannets.com/iXHT95hehFLPz9jL1/92707 CertificateIssuerLet's Encrypt Subjectduomoscrinkum.shop Fingerprint9F:47:EC:B9:44:5C:E5:DF:2F:EE:44:31:BB:2D:E6:6A:68:69:7E:82 ValidityTue, 11 Feb 2025 17:22:29 GMT - Mon, 12 May 2025 17:22:28 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
OPTIONS /cuid/?f=https%3A%2F%2Fmalakingannets.com HTTP/1.1
Host: duomoscrinkum.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://malakingannets.com/
Origin: https://malakingannets.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:21 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://malakingannets.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| malakingannets.com/favicon.ico | 23.109.170.154 | 200 OK | 1.4 kB |
URL GET HTTP/1.1malakingannets.com/favicon.ico IP23.109.170.154:443
Requested byhttps://malakingannets.com/iXHT95hehFLPz9jL1/92707 CertificateIssuerLet's Encrypt Subjectmalakingannets.com FingerprintE1:A5:41:5F:72:3D:1D:A9:FC:3A:4F:E6:EF:BB:07:3E:30:4C:8F:38 ValidityWed, 08 Jan 2025 07:33:24 GMT - Tue, 08 Apr 2025 07:33:23 GMT
File typeMS Windows icon resource - 1 icon, 16x16 Hash011201ab56695ce86ea2f190bce2670b bb8fad6accf293e619360935047c23f00da3c769 a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: malakingannets.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://malakingannets.com/iXHT95hehFLPz9jL1/92707
Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:21 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Fri, 28 Feb 2025 15:33:16 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "67c1d73c-57e"
Expires: Sat, 01 Mar 2025 22:52:21 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
|
|
| duomoscrinkum.shop/cuid/?f=https%3A%2F%2Fmalakingannets.com | 188.42.247.220 | 200 OK | 32 B |
URL OPTIONS HTTP/1.1duomoscrinkum.shop/cuid/?f=https%3A%2F%2Fmalakingannets.com IP188.42.247.220:443
Requested byhttps://malakingannets.com/iXHT95hehFLPz9jL1/92707 CertificateIssuerLet's Encrypt Subjectduomoscrinkum.shop Fingerprint9F:47:EC:B9:44:5C:E5:DF:2F:EE:44:31:BB:2D:E6:6A:68:69:7E:82 ValidityTue, 11 Feb 2025 17:22:29 GMT - Mon, 12 May 2025 17:22:28 GMT
Hash446fd3e354497a2b9307cafa099a8840 e9f13a59dfbf3eb46555cf6e1352697b2422c8c5 888a4d6a7b1e9a2776a0ebcbfa48d109c0fba852b7c6191db9e208dadef59ed2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cuid/?f=https%3A%2F%2Fmalakingannets.com HTTP/1.1
Host: duomoscrinkum.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://malakingannets.com/
Content-Type: application/json
Content-Length: 10
Origin: https://malakingannets.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:21 GMT
Content-Type: application/json
Content-Length: 32
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://malakingannets.com
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: a97fa794a0f9=676697cbbd23e644c40a80; expires=Mon, 17 Jun 2052 20:18:56 GMT; domain=duomoscrinkum.shop; path=/; secure; SameSite=None
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| bandogsogtiern.top/iqJlhICvlJIPpvwksrdnBLiNWZ/92707/?md=eyJ0dmMiOjAsImEiOjE4ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL21hbGFraW5nYW5uZXRzLmNvbS9pWEhUOTVoZWhGTFB6OWpMMS85MjcwNyIsImgiOjkxOTYsImwiOiJlbi1VUyIsInQiOjAsInoiOjk2MjUsImsiOjQsInUiOiI2NzY2OTdjYmJkMjNlNjQ0YzQwYTgwIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6Ijc1eXRxZnNsYzBvYWVuYiIsIm8iOnRydWUsIm0iOjE3NDA3ODMxNDE5NTgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=v4A2ydNQikjF0vsPgh03nyFh_4I8DRkIGbsDMTQ6Pik | 212.117.187.140 | 200 OK | 61 B |
URL User Request GET HTTP/1.1bandogsogtiern.top/iqJlhICvlJIPpvwksrdnBLiNWZ/92707/?md=eyJ0dmMiOjAsImEiOjE4ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL21hbGFraW5nYW5uZXRzLmNvbS9pWEhUOTVoZWhGTFB6OWpMMS85MjcwNyIsImgiOjkxOTYsImwiOiJlbi1VUyIsInQiOjAsInoiOjk2MjUsImsiOjQsInUiOiI2NzY2OTdjYmJkMjNlNjQ0YzQwYTgwIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6Ijc1eXRxZnNsYzBvYWVuYiIsIm8iOnRydWUsIm0iOjE3NDA3ODMxNDE5NTgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=v4A2ydNQikjF0vsPgh03nyFh_4I8DRkIGbsDMTQ6Pik IP212.117.187.140:443
CertificateIssuerZeroSSL Subjectbandogsogtiern.top FingerprintD0:EC:FA:A7:99:5F:6C:AF:2B:5A:C4:FD:15:1C:3C:C8:A1:EC:92:43 ValidityMon, 03 Feb 2025 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeHTML document, ASCII text, with no line terminators Hash86733bb66fb84b851592d733e51f0cbd 42eaf19a5ca195667a9212b0ea3557eee76954a8 927676bdf7f1bdcd71f06cc0d9fa573791b12c905629d806851624687c4b4a0d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /iqJlhICvlJIPpvwksrdnBLiNWZ/92707/?md=eyJ0dmMiOjAsImEiOjE4ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL21hbGFraW5nYW5uZXRzLmNvbS9pWEhUOTVoZWhGTFB6OWpMMS85MjcwNyIsImgiOjkxOTYsImwiOiJlbi1VUyIsInQiOjAsInoiOjk2MjUsImsiOjQsInUiOiI2NzY2OTdjYmJkMjNlNjQ0YzQwYTgwIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6Ijc1eXRxZnNsYzBvYWVuYiIsIm8iOnRydWUsIm0iOjE3NDA3ODMxNDE5NTgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=v4A2ydNQikjF0vsPgh03nyFh_4I8DRkIGbsDMTQ6Pik HTTP/1.1
Host: bandogsogtiern.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://malakingannets.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Sat, 01-Mar-2025 22:52:22 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Sat, 01-Mar-2025 22:52:22 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| bandogsogtiern.top/favicon.ico | 212.117.187.140 | 200 OK | 1.4 kB |
URL GET HTTP/1.1bandogsogtiern.top/favicon.ico IP212.117.187.140:443
Requested byhttps://bandogsogtiern.top/iqJlhICvlJIPpvwksrdnBLiNWZ/92707/?md=eyJ0dmMiOjAsImEiOjE4ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL21hbGFraW5nYW5uZXRzLmNvbS9pWEhUOTVoZWhGTFB6OWpMMS85MjcwNyIsImgiOjkxOTYsImwiOiJlbi1VUyIsInQiOjAsInoiOjk2MjUsImsiOjQsInUiOiI2NzY2OTdjYmJkMjNlNjQ0YzQwYTgwIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6Ijc1eXRxZnNsYzBvYWVuYiIsIm8iOnRydWUsIm0iOjE3NDA3ODMxNDE5NTgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=v4A2ydNQikjF0vsPgh03nyFh_4I8DRkIGbsDMTQ6Pik CertificateIssuerZeroSSL Subjectbandogsogtiern.top FingerprintD0:EC:FA:A7:99:5F:6C:AF:2B:5A:C4:FD:15:1C:3C:C8:A1:EC:92:43 ValidityMon, 03 Feb 2025 00:00:00 GMT - Sun, 04 May 2025 23:59:59 GMT
File typeMS Windows icon resource - 1 icon, 16x16 Hash011201ab56695ce86ea2f190bce2670b bb8fad6accf293e619360935047c23f00da3c769 a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: bandogsogtiern.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bandogsogtiern.top/iqJlhICvlJIPpvwksrdnBLiNWZ/92707/?md=eyJ0dmMiOjAsImEiOjE4ODQsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL21hbGFraW5nYW5uZXRzLmNvbS9pWEhUOTVoZWhGTFB6OWpMMS85MjcwNyIsImgiOjkxOTYsImwiOiJlbi1VUyIsInQiOjAsInoiOjk2MjUsImsiOjQsInUiOiI2NzY2OTdjYmJkMjNlNjQ0YzQwYTgwIiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6Ijc1eXRxZnNsYzBvYWVuYiIsIm8iOnRydWUsIm0iOjE3NDA3ODMxNDE5NTgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6InVuY2hlY2tlZCIsInZyIjoidW5jaGVja2VkIiwiYWMiOjE2LCJjdCI6InVua25vd24iLCJjZXQiOiJ1bmtub3duIiwiY2RsbSI6LTEsImNkbCI6LTEsImNydHQiOi0xLCJ0bXMiOjYwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=v4A2ydNQikjF0vsPgh03nyFh_4I8DRkIGbsDMTQ6Pik
Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 28 Feb 2025 22:52:22 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Fri, 28 Feb 2025 15:33:17 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "67c1d73d-57e"
Expires: Sat, 01 Mar 2025 22:52:22 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes
|
|