| fqbwzrktmgnuy.pink/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 | 172.67.136.214 | 200 OK | 11 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 11016, version 1.0 Hash15fa3062f8929bd3b05fdca5259db412 6ff06a34f68ad0324ddec1bbe4d453c959178b36 5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /KFOmCnqEu92Fr1Mu4mxKKTU1Kg.465390c6e54c60f4a15f.woff2 HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/main.949acaf34f3882f511ff.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:43 GMT
content-type: font/woff2
content-length: 11016
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
etag: "674840af-2b08"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BRisyPhaq5HFMUl4Jn%2F%2Ft2%2FUPfdNhP1J3rghdfHruTQjX%2BHL2mkFv0wDxCKTkUP6GI5gCeo1GmwF8lSN11fnnnT6k800xAnZuFOh8QN5OG%2BRp42o7VW%2FkN8WBGjFHiIN1cxdspE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f7875e9e9eb5684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2515&min_rtt=1542&rtt_var=981&sent=145&recv=23&lost=0&retrans=0&sent_bytes=151802&recv_bytes=3600&delivery_rate=1816910&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=1138&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/notification.mp3 | 172.67.136.214 | 206 Partial Content | 11 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/notification.mp3 IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeAudio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo Hasheba09b6a457792c52fc610b5f9f974b3 95e6e0f7648e28ea21bc434054ea59aba3a35aea 86093551f5a7f68c7dcac947bd8dc54c6a79dd9a5d83f7e40116d640eb28c7d6
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /notification.mp3 HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 206 Partial Content
date: Wed, 25 Dec 2024 11:23:43 GMT
content-type: audio/mpeg
content-length: 10880
last-modified: Thu, 28 Nov 2024 10:06:40 GMT
etag: "674840b0-2a80"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
content-range: bytes 0-10879/10880
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FDq45UIYLQnet8C5nF4F%2BmtUH1IrucuyxrvHiqrQyw8ZHwy9lVjl%2B1J7ER5yOkKFDoZvUYnJll2MdeH3csEsiEnh6tt36sz4wlhCO2%2FBMxRNMG0NzWukTI%2FiZTi%2BgfnkIAqcTCs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f7875ea0a0a5684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2403&min_rtt=1542&rtt_var=959&sent=155&recv=24&lost=0&retrans=0&sent_bytes=163779&recv_bytes=3646&delivery_rate=28491&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=1176&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/icon-192x192.png | 172.67.136.214 | 200 OK | 3.1 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/icon-192x192.png IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typePNG image data, 192 x 192, 8-bit colormap, non-interlaced Hash1a1650d2c76bfc1ac484646c19e495b9 fe58d66042ce9241226f5da9370230285ff604fc 6e587a62c9d7a97f25265ab5eb29d101ad2e36810042a4116d2dd29da96b0bf8
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /icon-192x192.png HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:43 GMT
content-type: image/png
content-length: 3059
last-modified: Thu, 28 Nov 2024 10:06:40 GMT
etag: "674840b0-bf3"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p5loowXCmxENW4zpXgSBf3JNAp8qo%2Fz76wo%2BbuFIC52pI8AdMkomXPscJjTAZ8blNbsLTsVYSAtFEXR8IngT35eZS%2BDt9aYiHrzhZluJv0qKR6eZJmjlXvo5wLz7KL0LRZsTe04%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f7875eb3b775684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2276&min_rtt=1542&rtt_var=776&sent=167&recv=26&lost=0&retrans=0&sent_bytes=176931&recv_bytes=3738&delivery_rate=784420&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=1373&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| hu.bafanglaicai.app/api/send | 104.21.42.79 | 204 No Content | 0 B |
URL POST HTTP/3hu.bafanglaicai.app/api/send IP 104.21.42.79:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectbafanglaicai.app Fingerprint35:8B:28:B8:E2:98:28:75:E7:8D:2E:31:6F:2C:79:5E:CF:32:09:64 ValidityFri, 20 Dec 2024 07:00:08 GMT - Thu, 20 Mar 2025 07:58:34 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /api/send HTTP/1.1
Host: hu.bafanglaicai.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://fqbwzrktmgnuy.pink/
Origin: https://fqbwzrktmgnuy.pink
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Wed, 25 Dec 2024 11:23:44 GMT
content-length: 0
x-dns-prefetch-control: on
content-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' undefined
access-control-allow-origin: *
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
vary: Access-Control-Request-Headers
access-control-allow-headers: content-type
access-control-max-age: 86400
cf-cache-status: DYNAMIC
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e8%2BaLtzqFugeI4EGo32EZ5YTc%2BphpA%2BgFFduCywJYsYDYBsNTXwRVj8XEfBfGKa7Jdj41d2UyGKHjkSU1LY96pcYk%2FGc7EUSmD%2F2S0MQEERD1pVTbjU5k4GV2htg0CaHxrb6TKGK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875ed8886b518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5241&min_rtt=4477&rtt_var=2224&sent=11&recv=8&lost=0&retrans=0&sent_bytes=4077&recv_bytes=1204&delivery_rate=132654&cwnd=12000&unsent_bytes=0&cid=13a2eb342aee61cb&ts=450&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/main.949acaf34f3882f511ff.css | 172.67.136.214 | 200 OK | 32 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/main.949acaf34f3882f511ff.css IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typegzip compressed data, from Unix Hash7ea6c286e281aae9f60a09c11854eb09 e30804877fae890f388fbd66e5bbba069504dc8c 273a5e676dd3281a58edf0e3550033dbb86796362dfaa60a4c5922589168e35d
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /main.949acaf34f3882f511ff.css HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: text/css
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-1ba95"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ma4s9EFgeWNU%2BD5JVeYoFDafag%2FnvVL38P2beZJjVToWyXo9WLCFzw0PFE3Ru%2FnDGbOG8fk3iEaRz%2F%2F8h1kW2yx3UOStSLcnyRQJthofGMia%2BoXkYChE0Nt%2FGR146sZiUYEykA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875e68e965684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2601&min_rtt=1542&rtt_var=1077&sent=117&recv=18&lost=0&retrans=0&sent_bytes=123208&recv_bytes=2290&delivery_rate=1038905&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=624&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/main.d54bfa037348b154a941.js | 172.67.136.214 | 200 OK | 118 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/main.d54bfa037348b154a941.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typegzip compressed data, from Unix Size118 kB (118379 bytes) Hash853096c7b2fe002d9db301910ad2c3ed 57a9026b8619a8b9ac9bfa8a91fe020fb5603689 74fa9067f4d02b0db9b09d71ed915b6c542738f9214b4393bad9dad15f67e5fd
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /main.d54bfa037348b154a941.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-48637"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4btcBrw9tkg6RoUDmuECPlfZI%2BZlKp%2FENgHAxKznTpDu1PYrNHhsY2fvZOSuMdTiIorbvxyyVtOuuWznHmQggJwsgxKDMEbTIYYai%2Bp4Fy1vVfW0mVeDrV1N3Xjj9A%2BBIf5LCxo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875e68e945684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2895&min_rtt=1542&rtt_var=1544&sent=17&recv=12&lost=0&retrans=0&sent_bytes=4294&recv_bytes=2024&delivery_rate=381803&cwnd=12000&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=566&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| hu.bafanglaicai.app/api/send | 104.21.42.79 | 200 OK | 7.9 kB |
URL POST HTTP/3hu.bafanglaicai.app/api/send IP 104.21.42.79:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectbafanglaicai.app Fingerprint35:8B:28:B8:E2:98:28:75:E7:8D:2E:31:6F:2C:79:5E:CF:32:09:64 ValidityFri, 20 Dec 2024 07:00:08 GMT - Thu, 20 Mar 2025 07:58:34 GMT
File typeASCII text, with very long lines (603), with no line terminators Hash0c57c2498c937cdb4ca2d9342318abee 69c6a283d11178cf3680a41989806b8a9fb39655 1f681de14ae220fa800b5482f45a9038a0a5da31a0744a88229d65f4cef25bae
POST /api/send HTTP/1.1
Host: hu.bafanglaicai.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fqbwzrktmgnuy.pink/
Content-Type: application/json
Content-Length: 178
Origin: https://fqbwzrktmgnuy.pink
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:44 GMT
content-type: text/plain
x-dns-prefetch-control: on
content-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' undefined
access-control-allow-origin: *
etag: W/"kl3m0pkl35gr"
vary: Accept-Encoding
cf-cache-status: DYNAMIC
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FbPWe6EunA8AIe6oJnPh7N8DYyQPSZT5Hi8eP1Q7Hf%2BSWjzksPIquesjnLFFmxsQWoF5o3SH6UZlosHaozwNAyKCqo0ZwstG277WSbF0BRwX5wWYzbD%2FE1JUiHDT6XY%2FViVeLr0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875f04bedb518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5645&min_rtt=4477&rtt_var=2477&sent=13&recv=10&lost=0&retrans=0&sent_bytes=5020&recv_bytes=1710&delivery_rate=2020&cwnd=12000&unsent_bytes=0&cid=13a2eb342aee61cb&ts=698&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js | 172.67.136.214 | 200 OK | 82 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typegzip compressed data, from Unix Hash44ef6285ac7e048859e1087876cfdf51 6ac01174849d40fd30d224c08d2177de34ce522e a0c4d5c5870e7f91e2ea7e81947284e410d9f2cc7c1a47c5ab4638334fea9df9
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /2976.4e6e9b1254ce313f06c5.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: worker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:46 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-3878"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BzvyPL35cxnNHubDIi57l13bQuz45OEEy9u8qILw76REDryn9QVgtyzw8suTq8Vxq9jdVN387ovpjEXwBTgEUPwqUavrtI6rHJ3lO5EWEVjO7aztlR2XQsX%2B6bu2lJM%2FX68JXgc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875ff88665684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2200&min_rtt=1542&rtt_var=557&sent=180&recv=33&lost=0&retrans=0&sent_bytes=185673&recv_bytes=5179&delivery_rate=11164&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=4548&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js | 172.67.136.214 | 200 OK | 22 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (21340) Hasha0980d43cea486530c30f9f5e1c1b5e4 deec93f70f8b813b479137075afa6a0a3a25b8bd 4b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wntEwfpVdY2ctjvk7P3vvrNW2hUAHW1vC28dN%2Bf7S1Z5Q63yac%2By%2Fh6uN7ujOLRxgGVoGo2MPBGrchwKPe9ona7ZZS2KAzMM2XOaAI8v0e3al5ls8kENr%2BTy%2BQAdCbiMlafX1S8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f787601fab75684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2113&min_rtt=1475&rtt_var=687&sent=212&recv=41&lost=0&retrans=0&sent_bytes=215804&recv_bytes=6518&delivery_rate=5021133&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=4951&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js | 172.67.136.214 | 200 OK | 140 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size140 kB (140233 bytes) Hashfdd268f67cf5c4f79320041e3d156e98 d66194ee702467dd19130dee59bd824990f5bc71 36e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-223c9"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lB4MHmRzKtfDcBPyxc4NHAcglpB8UIC85zzzsrWQSFhlmjx8Fb7UgBRzP8e10tyPWb2OL66o7ONhHZ3Dw2Kk3nyX4XZYYPPiqrKUsCc1W39X546Yr%2Bp%2BT%2BNC%2BoqHVEHdMLLB1s8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f787604ae325684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2086&min_rtt=1466&rtt_var=659&sent=280&recv=50&lost=0&retrans=0&sent_bytes=290216&recv_bytes=7905&delivery_rate=108894&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5378&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/redirect.js | 172.67.136.214 | 200 OK | 325 B |
URL GET HTTP/3fqbwzrktmgnuy.pink/redirect.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeASCII text, with very long lines (336), with no line terminators Hash0f4bee764cf7e7080cc0c1a836d6c85a 7cdea3a612218fe6898aa117eb4598d7d0dce420 9d8ec261dba46e501288de7aee04435dfe1d8728b0bf65a4a79c08e5c90a5b54
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /redirect.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:40 GMT
etag: W/"674840b0-145"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=70y1T7bu9Z2O%2F96gNRRfx3SDUup0qDqRvH1pD7DyFEFguzu%2BLP%2FlvkRJnTjY3Xdy%2BRtFqoWLpvc7M8OEYdkbYMvPsiezgA9hzi4uT35cgz90IAa9vl3cu6%2FTOTExOKki2IwQSDg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f7875e68e925684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2601&min_rtt=1542&rtt_var=1077&sent=116&recv=18&lost=0&retrans=0&sent_bytes=122318&recv_bytes=2290&delivery_rate=1038905&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=610&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js | 172.67.136.214 | 200 OK | 66 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash4441938ee433d3657c20d454d352a336 dd67121d7fda7c17be196f60c72dfa06bcb5bc6f 659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:48 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vMzE2kEdwBlrkZIgReW4CKNF7jsoNTfT8LC0GPyaPy35fdHySrSDcOdVLySuTFQyjfSK7lfBSBTP0BJR3mfuO4DHKYML0o0ybxEf63jsNHJGT5UExNMHCXx33%2BQfs6ixIrBT75A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f78760759405684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2191&min_rtt=1466&rtt_var=758&sent=441&recv=61&lost=0&retrans=0&sent_bytes=473983&recv_bytes=9620&delivery_rate=14260055&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5851&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js | 172.67.136.214 | 200 OK | 22 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (21340) Hasha0980d43cea486530c30f9f5e1c1b5e4 deec93f70f8b813b479137075afa6a0a3a25b8bd 4b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2B%2FGh2FgwvWWA6QOAfmyxeo2bDRTPBD9Jt3Mj478EwEWlddn662Vq8L%2F8DD3QXc2ORRFmmDzgMnWvV1dQDTLrFB2DlGu8WXNHNivzSxsmfYoLGJi7xAm8FliINtsw9Krh3KWPuQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7876023b125684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2172&min_rtt=1466&rtt_var=939&sent=239&recv=47&lost=0&retrans=0&sent_bytes=243283&recv_bytes=7524&delivery_rate=357452&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5010&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| hu.bafanglaicai.app/script.js | 104.21.42.79 | 200 OK | 2.6 kB |
URL GET HTTP/2hu.bafanglaicai.app/script.js IP 104.21.42.79:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectbafanglaicai.app Fingerprint35:8B:28:B8:E2:98:28:75:E7:8D:2E:31:6F:2C:79:5E:CF:32:09:64 ValidityFri, 20 Dec 2024 07:00:08 GMT - Thu, 20 Mar 2025 07:58:34 GMT
File typeJavaScript source, ASCII text, with very long lines (2662), with no line terminators Hash6cdaf836f824e10f1a7e125a6df339f5 7c85697dcd8a6a3a88c48394893f0f8f228d3de2 cf8d4f03f3ca04b73e86ba9a5649a7d431ea510f7c7bd11df59639ef86c70618
GET /script.js HTTP/1.1
Host: hu.bafanglaicai.app
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: application/javascript; charset=UTF-8
x-dns-prefetch-control: on
content-security-policy: default-src 'self';img-src * data:;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' undefined
cache-control: public, max-age=14400
last-modified: Wed, 28 Aug 2024 02:52:03 GMT
etag: W/"a11-19196e5b838"
vary: Accept-Encoding
content-encoding: gzip
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2BZ8y4xstZvMBUNnozZNR8VBWOTOQ6Iq3Nqa%2BHFwtVADyQNCJ%2BVqF9JJVKD69C6ayKnlthyv8pjgPG67eoUDEEHZ%2FBELoMkMvsxHAzTH0GuT9COzvYfx0TC7yHWL3xubHR5B3Z7z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875e6a947b4eb-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5575&min_rtt=429&rtt_var=10261&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3285&recv_bytes=1195&delivery_rate=6714064&cwnd=254&unsent_bytes=0&cid=03471585721fdc19&ts=451&x=0"
X-Firefox-Spdy: h2
|
|
| fqbwzrktmgnuy.pink/8673.1b6dd8d303b0535cc1f8.js | 172.67.136.214 | 200 OK | 11 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/8673.1b6dd8d303b0535cc1f8.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (10642) Hashea8d5208dada45e8d0844877a7c93db6 45d98fbe3dae09a988cccd836d39016c5100f313 25f447387cefb643c04e0aa816e21edf562ebe9b7e3f7b808bdb179154fc17b8
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /8673.1b6dd8d303b0535cc1f8.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:46 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-29c8"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dbgqbfk20fYCSb4dNw5544LTViY%2BTs2sZrmPeyAaBXKbG5tsk7qn6RUxnDOiE71scuozE4y9Zkf83UtFtl94VEG0QLnHB39BPUuax58Vb%2Bw3o83Rvbsn5bbedpoz0zoqIOnn4MM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875fcad7b5684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2215&min_rtt=1542&rtt_var=703&sent=172&recv=28&lost=0&retrans=0&sent_bytes=180802&recv_bytes=4041&delivery_rate=2143696&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=4152&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js | 172.67.136.214 | 200 OK | 22 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (21340) Hasha0980d43cea486530c30f9f5e1c1b5e4 deec93f70f8b813b479137075afa6a0a3a25b8bd 4b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=55g3hNxltGgZRiLrIjehffsKVtvHHtSazwUI2NHQ74L1PUQz4Gap8FzKYI5c3%2FKVbg1iS9TNijo2DA%2FVxKy4ANxHK9Rf9Oj6UYADgc%2BkCxXQl0e%2FgtMCx128BodGXxYLf%2FyNj7M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7876023b175684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2273&min_rtt=1475&rtt_var=983&sent=230&recv=45&lost=0&retrans=0&sent_bytes=234118&recv_bytes=7189&delivery_rate=53175&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=4993&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js | 172.67.136.214 | 200 OK | 140 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size140 kB (140233 bytes) Hashfdd268f67cf5c4f79320041e3d156e98 d66194ee702467dd19130dee59bd824990f5bc71 36e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-223c9"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kVfxI40Fxxd%2BXcj1WufMttEOjvbweEBLqxokhtQ0v%2FaqNNarLH2QccJuLhLZRJqPJaqsBnrtHR4AEhHPQMATFQF%2Fv00D2Djpv10QRJaWU4btjP%2BBFuKmaql%2BS3q4p%2BDtjRvrraw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7876046df25684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2277&min_rtt=1466&rtt_var=974&sent=346&recv=54&lost=0&retrans=0&sent_bytes=365821&recv_bytes=8587&delivery_rate=3526692&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5412&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/compatTest.js | 172.67.136.214 | 200 OK | 2.5 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/compatTest.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (2610), with no line terminators Hash6cfbdd49583de4aef06544f30e1eafb9 b852473e5433f95a06bf58c7e625876a14358422 9f053b9be11ee313213aaf4d5269f4a011e068ed6eaf12a557634381fc42c9ec
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /compatTest.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:40 GMT
vary: Accept-Encoding
etag: W/"674840b0-9f0"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FxtG%2FpoJb6TgV52K0EzGsiADFPFX%2BcfU3vl%2F9LsBA0Snndg%2FoQ%2BPceX0RwLIFE%2BwVWJUoL%2ForReXqOf3zg6tDV9kIx2%2BKhoLXwIHww9btMcTLHnhihMtLsbRSMz56yPLRacYAeI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875e68e975684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2734&min_rtt=1542&rtt_var=1082&sent=114&recv=17&lost=0&retrans=0&sent_bytes=120581&recv_bytes=2244&delivery_rate=18014943&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=605&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js | 172.67.136.214 | 200 OK | 22 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/7784.df07a876b22e3b2a83e9.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (21340) Hasha0980d43cea486530c30f9f5e1c1b5e4 deec93f70f8b813b479137075afa6a0a3a25b8bd 4b5eeb1400e5118a1aff286d9a6cf893bd7c08fc8247c62116238ea587890e9e
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /7784.df07a876b22e3b2a83e9.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-53e5"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S5TGiwLunnS7%2F%2Bk6sHdr3UphKsJs3ZYZRNItpEDn7fg9cWz5VvVxfh%2BApaaW2dvm64ppdooXihzk%2FJsGRYF43YQY6aI6Xj4936Ue3T3HYumuBPmqw1JE2EPL6eva%2BlaEnQbejdo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f787601fac75684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2113&min_rtt=1475&rtt_var=687&sent=220&recv=41&lost=0&retrans=0&sent_bytes=224934&recv_bytes=6518&delivery_rate=5021133&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=4956&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js | 172.67.136.214 | 200 OK | 140 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size140 kB (140233 bytes) Hashfdd268f67cf5c4f79320041e3d156e98 d66194ee702467dd19130dee59bd824990f5bc71 36e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-223c9"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nhZMqa52nGY8ENY4d1QzPU2P1Mp88jFtspanB79xijefOOf9GAra0rqp9N%2B0QAQIIeJS0vCfFuJBMOMk3IQ8bSjjPBfgyam0uqZnVvB4tVnwL8W5%2B3nklC5j5ORBrMTmKo7lHhQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f787604be4f5684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2022&min_rtt=1466&rtt_var=621&sent=313&recv=52&lost=0&retrans=0&sent_bytes=328020&recv_bytes=8246&delivery_rate=10167729&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5400&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js | 172.67.136.214 | 200 OK | 66 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash4441938ee433d3657c20d454d352a336 dd67121d7fda7c17be196f60c72dfa06bcb5bc6f 659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:48 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=15FBmzh%2BUrJ9Y1T8YifSEZ9IVDJUS05B6LAnVSGNEy5dskc%2FOEln47DHEz7yV1Nj652eEYGuOKLnnIGZyF%2Bg7%2FliPi14tVLBIN3UczqfXWqugDkDBChQMjUUtsQVPJaKiwkB%2FTI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f78760719015684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2410&min_rtt=1466&rtt_var=998&sent=380&recv=57&lost=0&retrans=0&sent_bytes=403657&recv_bytes=9223&delivery_rate=9691829&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5770&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js | 172.67.136.214 | 200 OK | 66 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash4441938ee433d3657c20d454d352a336 dd67121d7fda7c17be196f60c72dfa06bcb5bc6f 659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:48 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sbgT7KpxBZOKhZYd7SMLZdh2TSszJKRcYHHm24K9UVwwxAeWeZKgDrcRmu40mVZJ7vYScfN8QERTU4WLqx7y4kQwE24QVSToE%2Fzip2W1psi2lddIMtc%2FhswvmbGHV%2FeyiIuZ9l4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f78760729125684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2329&min_rtt=1466&rtt_var=912&sent=401&recv=59&lost=0&retrans=0&sent_bytes=427118&recv_bytes=9529&delivery_rate=67249&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5838&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js | 172.67.136.214 | 200 OK | 66 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/rlottie-wasm.f013598f1b2ba719f25e.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash4441938ee433d3657c20d454d352a336 dd67121d7fda7c17be196f60c72dfa06bcb5bc6f 659bf63501a8054ef0eedda3dec466dbc1e9a1b2c4d5d59a285b005215e16679
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /rlottie-wasm.f013598f1b2ba719f25e.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:48 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-10037"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iTUSwz7Z1khdftWh%2BDnZr2mJqKgjkxIBS%2B2g%2Fru5Nh95lk1%2Bssx1kbGAuKkPomrMLgGjLhKCqFJIn7AEoZAdHYgxY67vV%2BvZH2CC1wKw%2Br4vTmkKH0htH3AZicROsLbYH%2BHFgI8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f78760749315684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2270&min_rtt=1466&rtt_var=801&sent=421&recv=60&lost=0&retrans=0&sent_bytes=450546&recv_bytes=9575&delivery_rate=497071&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5845&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| | 172.67.136.214 | 200 OK | 3.7 kB |
URL User Request GET HTTP/2IP 172.67.136.214:443
CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeHTML document, ASCII text, with very long lines (3851), with no line terminators Hash5c65b8a5dca5fdf469959f93273bd42c acbbc1ad2113af626536ad11ba7f58076c572f58 04c99312040777aa25a3e102626d252d33940f238d79cfac9a2a40c8bbb9e84a
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Dec 2024 11:23:42 GMT
content-type: text/html
last-modified: Sat, 14 Dec 2024 10:26:51 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HTXVNKrQu9K1VTUBRgzOKxIDH0u%2FaRvHOoxUdtV1dltq1yGUQuv1Tlj%2FtiMC78%2FoqBF%2FkJ%2BP7ZRoadymwWB7p8jCdtMRIWH8mfEyvDiq2PogIF3kcWAIGGXsBDI%2FVLF0RCdCBJI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7875e26ed45695-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5868&min_rtt=439&rtt_var=10858&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3296&recv_bytes=1251&delivery_rate=7425641&cwnd=254&unsent_bytes=0&cid=f158def3d437097e&ts=455&x=0"
X-Firefox-Spdy: h2
|
|
| fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js | 172.67.136.214 | 200 OK | 140 kB |
URL GET HTTP/3fqbwzrktmgnuy.pink/5905.db5d2749ecb90aaf2752.js IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size140 kB (140233 bytes) Hashfdd268f67cf5c4f79320041e3d156e98 d66194ee702467dd19130dee59bd824990f5bc71 36e5ef6880e869bdf9ef2119932dbac7330513aefc50839cc2a6fdde7b519967
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /5905.db5d2749ecb90aaf2752.js HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/2976.4e6e9b1254ce313f06c5.js
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:47 GMT
content-type: application/javascript
last-modified: Thu, 28 Nov 2024 10:06:39 GMT
vary: Accept-Encoding
etag: W/"674840af-223c9"
content-encoding: gzip
cache-control: max-age=14400
cf-cache-status: REVALIDATED
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cZSsCV0BIK02jNmFEV3dJCvPHfEzekERsQJe0Vukd6XQbiJqOeUQmRb7L4gKTjwl%2Bxj3fKgZ6eFA9ie80gEx7Mv7cjh%2BVoTSlvDKbSonB5rvoaaNzE4V%2Fk4k64%2FcD2dDcqr4us4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7876047df75684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2089&min_rtt=1466&rtt_var=869&sent=248&recv=49&lost=0&retrans=0&sent_bytes=252439&recv_bytes=7859&delivery_rate=1000268&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=5364&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| fqbwzrktmgnuy.pink/favicon.svg | 172.67.136.214 | 200 OK | 892 B |
URL GET HTTP/3fqbwzrktmgnuy.pink/favicon.svg IP 172.67.136.214:443
Requested byhttps://fqbwzrktmgnuy.pink/ CertificateIssuerGoogle Trust Services Subjectfqbwzrktmgnuy.pink Fingerprint52:D4:D5:F8:10:57:BC:62:5D:5F:EC:FE:90:73:7B:F9:E9:E3:91:F1 ValiditySun, 22 Dec 2024 03:31:43 GMT - Sat, 22 Mar 2025 04:29:49 GMT
File typeSVG Scalable Vector Graphics image Hashfbfd454715d8180275b32bd48770a483 0716abb57416f83cfad3e17ff830039c0607b313 788c238be3597ef42c549caff599bb84e584790f43f7d6013d6a1987264bdbe1
Analyzer | Verdict | Alert | OpenPhish | phishing | Telegram | Quad9 DNS | malicious | Sinkholed |
GET /favicon.svg HTTP/1.1
Host: fqbwzrktmgnuy.pink
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fqbwzrktmgnuy.pink/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 25 Dec 2024 11:23:43 GMT
content-type: image/svg+xml
last-modified: Thu, 28 Nov 2024 10:06:40 GMT
etag: W/"674840b0-37c"
cache-control: max-age=14400
cf-cache-status: MISS
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0cxr0Beq3q0JCL7jSCHajnAcbZkcTEe4rmUExWJZ1f%2FFwfc3hiweLrRfEJXAlY2nRt2QeKzxdjXzqoU25rj9zL6jGf9J8Bqa9nTmsIYrxBv%2BoUox60HrvrXtuQl1wQnN3fqB3Kg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8f7875eb3b795684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2368&min_rtt=1542&rtt_var=790&sent=165&recv=25&lost=0&retrans=0&sent_bytes=175650&recv_bytes=3692&delivery_rate=5599869&cwnd=93600&unsent_bytes=0&cid=d2d3d8a12b0a9380&ts=1355&x=1", cfExtPri, cfHdrFlush;dur=0
|
|