Report - stownrusis.com/s?DxAf

Report Overview

Submitted URL
stownrusis.com/s?DxAf
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-07 17:35:33
Access
public
Website Title
SkyBri - Updated
Final URL
stownrusis.com/s?DxAf
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
dfdgfruitie.xyz	unknown	2022-08-22	2022-12-12	2024-04-25	409 B	710 B	104.21.13.114
rswhowishedto.info	unknown	unknown	No data	No data	999 B	6.8 kB	104.21.63.117
gforanopportu.info	unknown	2023-11-07	2023-11-27	2024-04-25	509 B	900 B	104.21.25.241
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-05-07	520 B	8.7 kB	142.250.74.99
undefined	142677	unknown	2020-01-28	2023-07-23	960 B	0 B	0.0.0.0
d1wzdj81h1hubn.cloudfront.net	unknown	2008-04-25	2023-01-18	2024-04-14	492 B	209 kB	143.204.42.154
dre81lzpy0s7q.cloudfront.net	unknown	unknown	No data	No data	413 B	91 kB	3.164.247.13
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-05-07	948 B	26 kB	142.250.74.106
pogothere.xyz	unknown	2022-08-22	2022-09-04	2024-05-07	844 B	104 kB	188.114.97.1
stownrusis.com	unknown	2023-12-31	2024-02-01	2024-04-17	906 B	98 kB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-07	medium	undefined	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	stownrusis.com/s?DxAf	92 kB	2024-05-07	2024-05-07
Pretty URL stownrusis.com/s?DxAf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-07 19:35:39 Last Seen2024-05-07 19:35:39 Times Seen1 Hash f48b61d14cf96c23198823cbab5f2c1b 35f7cf351ec3d11c260d8a5e5fbd603913b4e874 7291ecfeb5310a4494797de2231774bcd64c273273ed6e08cee0d09587ef5858 Loading...

	dfdgfruitie.xyz/adserver/yzfdmoan.js	0 B	2023-03-07	2024-05-19
Pretty URL dfdgfruitie.xyz/adserver/yzfdmoan.js IP 104.21.13.114 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-19 16:15:34 Times Seen37832285 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	dre81lzpy0s7q.cloudfront.net/?tid=987353	230 kB	2024-05-07	2024-05-07
Pretty URL dre81lzpy0s7q.cloudfront.net/?tid=987353 IP 3.164.247.13 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-07 19:35:40 Last Seen2024-05-07 19:35:40 Times Seen2 Hash a171b9ef46de32a25879c43c92577353 b9412f6d74c12037999b3111e867334d8f2de6c8 ab883f36b67a8221b68312a64048e97333a6639711bc1f7c60af20af39398c0a Loading...

HTTP Transactions (14)

URL IP Response Size

d1wzdj81h1hubn.cloudfront.net/9f4ded7c321d0c1e83f2906fd499188c1df6a378a152d55156ac006c5733c26f.jpg

143.204.42.154

200 OK

209 kB

URL GET HTTP/2
d1wzdj81h1hubn.cloudfront.net/9f4ded7c321d0c1e83f2906fd499188c1df6a378a152d55156ac006c5733c26f.jpg
IP
143.204.42.154:443
ASN
#16509 AMAZON-02

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], progressive, precision 8, 640x821, components 3
Size
209 kB (208894 bytes)
Hash
3b342c82925b15e69b208835ba21afc2
1e1faf927e3bdba9ef37e8d56b02c4c7f93924ee
091187bd9fd22146ff8a221ed2006113e02b74719f25b2e89560fd08046eefde

HTTP Headers

GET /9f4ded7c321d0c1e83f2906fd499188c1df6a378a152d55156ac006c5733c26f.jpg HTTP/1.1
Host: d1wzdj81h1hubn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/jpeg
content-length: 208894
last-modified: Sun, 05 May 2024 07:38:21 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
date: Mon, 06 May 2024 23:20:33 GMT
etag: "3b342c82925b15e69b208835ba21afc2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: rinh_pQXqVzGSIOARLbuFpoTmNpW9U_t-D19V8nWV6LeguRPTXyUUg==
age: 65673
X-Firefox-Spdy: h2

dfdgfruitie.xyz/adserver/yzfdmoan.js

104.21.13.114

200 OK

0 B

URL GET HTTP/2
dfdgfruitie.xyz/adserver/yzfdmoan.js
IP
104.21.13.114:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectdfdgfruitie.xyz
Fingerprint9B:73:95:36:E6:2A:E8:AE:DA:A0:BE:44:07:A2:37:71:C9:26:70:46
ValidityFri, 29 Mar 2024 21:30:02 GMT - Thu, 27 Jun 2024 21:30:01 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /adserver/yzfdmoan.js HTTP/1.1
Host: dfdgfruitie.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 07 May 2024 17:35:05 GMT
content-type: application/x-javascript
content-length: 0
last-modified: Fri, 03 Feb 2023 19:26:28 GMT
etag: "63dd5fe4-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1880
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HzdToH6hbAW%2BKA65tvpyh2NbBCWgsjdacVNDC3slyoJ81tC1qgVlgPynkvxsYWFpoImYDuy1UBAOSmHB39iYgH13dMs1prde3bZ6if0i%2BzBFG4WLhxpZhGz28TTzAE%2FSjK4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8802f6ec99efb4f1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dre81lzpy0s7q.cloudfront.net/?tid=987353

3.164.247.13

200 OK

90 kB

URL GET HTTP/2
dre81lzpy0s7q.cloudfront.net/?tid=987353
IP
3.164.247.13:443
ASN
#0

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (891)
Size
90 kB (90170 bytes)
Hash
a171b9ef46de32a25879c43c92577353
b9412f6d74c12037999b3111e867334d8f2de6c8
ab883f36b67a8221b68312a64048e97333a6639711bc1f7c60af20af39398c0a

HTTP Headers

GET /?tid=987353 HTTP/1.1
Host: dre81lzpy0s7q.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 90170
date: Tue, 07 May 2024 17:35:05 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 08b84720fd9415ecb290dcdb71c8b776.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: XPkplZz8qlmKuHqkAwXu2_lzpw5orZXDgQukxUzgIrjKUCSOUCQcuw==
X-Firefox-Spdy: h2

rswhowishedto.info/S2pDbU1kVSAecAYsLy8ZJwUADwUJXCI8ISwPC1g7CT16Xit5XmUZJC9XelV6eF9wSz0iDn5eeG0ZNww5Phl+XGsiBCUCcG0cfl1jfkR1Q39tH35caz8aIgpwekwzGTknV3JafH5bc15+e1xzWXU

104.21.63.117

204 No Content

0 B

URL GET HTTP/2
rswhowishedto.info/S2pDbU1kVSAecAYsLy8ZJwUADwUJXCI8ISwPC1g7CT16Xit5XmUZJC9XelV6eF9wSz0iDn5eeG0ZNww5Phl+XGsiBCUCcG0cfl1jfkR1Q39tH35caz8aIgpwekwzGTknV3JafH5bc15+e1xzWXU
IP
104.21.63.117:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerLet's Encrypt
Subjectrswhowishedto.info
Fingerprint4E:37:EC:9E:24:62:7C:24:1C:D4:51:00:35:42:0A:CF:FC:62:C6:D7
ValidityMon, 01 Apr 2024 06:59:08 GMT - Sun, 30 Jun 2024 06:59:07 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /S2pDbU1kVSAecAYsLy8ZJwUADwUJXCI8ISwPC1g7CT16Xit5XmUZJC9XelV6eF9wSz0iDn5eeG0ZNww5Phl+XGsiBCUCcG0cfl1jfkR1Q39tH35caz8aIgpwekwzGTknV3JafH5bc15+e1xzWXU HTTP/1.1
Host: rswhowishedto.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Tue, 07 May 2024 17:35:06 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asBgYuBi%2BSQeB0gHd59loU96irSz2%2FVW8ZpO%2BAAw%2F%2F%2FJETJFYR%2FtvYMkQtr4gnXgdL4dZTFBFWMEVuh%2FlIvqwU2bn2NEm8y7YMlh8B2ykTq1DtX%2B6Ls0q4P0WGlw5O5r7YmeDys%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8802f6ef0fba56cb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

gforanopportu.info/tc

104.21.25.241

200 OK

0 B

URL POST HTTP/2
gforanopportu.info/tc
IP
104.21.25.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectgforanopportu.info
Fingerprint48:92:F7:78:56:FE:2F:3B:D3:E4:F3:00:68:41:17:58:CB:7C:AE:C9
ValiditySat, 27 Apr 2024 09:51:20 GMT - Fri, 26 Jul 2024 09:51:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

OPTIONS /tc HTTP/1.1
Host: gforanopportu.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Tue, 07 May 2024 17:35:06 GMT
set-cookie: ci=960773640262106; Max-Age=86400; Secure; SameSite=None
access-control-allow-origin: https://stownrusis.com
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m6OWn0xSCmJZ1EgYXDmbW2hWcXw9lMAhdLx7EcAJnJTep4yaxmD07FPhQK5Q5IrEuRud5EkjYOqWhBfcJRz7wi7oe%2BheGfWi5MAmNPcGEYPVwy2jWWUHuoM02co3Yt6WyVha59w%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8802f6f2296156ab-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

rswhowishedto.info/popunder.gif

104.21.63.117

200 OK

5.5 kB

URL GET HTTP/3
rswhowishedto.info/popunder.gif
IP
104.21.63.117:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerLet's Encrypt
Subjectrswhowishedto.info
Fingerprint4E:37:EC:9E:24:62:7C:24:1C:D4:51:00:35:42:0A:CF:FC:62:C6:D7
ValidityMon, 01 Apr 2024 06:59:08 GMT - Sun, 30 Jun 2024 06:59:07 GMT

File type
GIF image data, version 89a, 1 x 1
Size
5.5 kB (5530 bytes)
Hash
89f4dac7facb6e8c9c77373467d61747
5ac7f44c4bf0d3b0096de013be491f89dd1e6b4f
112199002bd39b2a700e9b235bcaf1f54fd5fc7735303453994e9d1fce886957

HTTP Headers

GET /popunder.gif HTTP/1.1
Host: rswhowishedto.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 07 May 2024 17:35:06 GMT
content-type: image/gif
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
cf-cache-status: HIT
age: 86049
last-modified: Mon, 06 May 2024 17:40:57 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PIPQK%2BAfgNrsamdbKOBHl9ZxXFG%2FzlZvByixPFsPqR7pmyET1%2FVwjnt12Y2yODSaft9a9SUo5x4i%2Bx5l62EN%2Bsd%2FwkjSLgqyNRDmR5yQOuKWWyxI87qZphScWpmIJufOyI1LcSs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8802f6f16c3b569c-OSL
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2

142.250.74.99

200 OK

7.9 kB

URL GET HTTP/2
fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
142.250.74.99:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7884, version 1.0
Size
7.9 kB (7884 bytes)
Hash
9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

HTTP Headers

GET /s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 02 May 2024 02:01:02 GMT
expires: Fri, 02 May 2025 02:01:02 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 22 Mar 2024 00:00:38 GMT
content-type: font/woff2
age: 488045
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap

142.250.74.106

200 OK

10 kB

URL GET HTTP/3
fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
gzip compressed data, max compression
Size
10 kB (10438 bytes)
Hash
ce514a0e6bb5c98ee6c26d70e69719c5
b8dd8a9eafa9538e1fda70461829216147335259
4fea837c7ddc9a50b703351534f49302306c74e0d1e5d85b7206fc015867a375

HTTP Headers

GET /css?family=Poppins:wght@300;400;500;600;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 07 May 2024 17:35:06 GMT
date: Tue, 07 May 2024 17:35:06 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

undefined/Q25ReHoiDDIVRSJTM14PMQJsXUgFS2M+HjELaUkWOR4oSAl0H38bFiwbNR4ILAAlVhQmGnRKPHELBAAWDSoAGTM0GgI7DXMCECkRDT8JDC0CPzUeKgEKAy0REktjPj8VGhU+AHc/A0lKCDc2IhgUOGkVPC8aMDsiBikzFDMkKBAiLAc8Nh80CzcCPC4aLBIpKCUnECobFl4DCTsFHgkqMnIqBy47IQ0HPSkSLzoSPiQCEz4DJC8EFEobJQA9KRI8OQA5BRoePTkCJAcqPA8tPTkbASgpXUgBOAMANxAmYDk4cDQyHhYVNwkqGXYmAz09EDoDHDsuGgEdP24vGRwWO0tjOiwWNBIgMnsFFSkwGwgUDygBBToKOwUKNz4XLzYyHyAJCActPwE7PUErAjcUMAMWNgQuMxQgFDk9IAUTTik0PwI8MgU7dxIJLAAhRRkZCAggGSJXMBQrAQ

0.0.0.0

0 B

URL GET
undefined/Q25ReHoiDDIVRSJTM14PMQJsXUgFS2M+HjELaUkWOR4oSAl0H38bFiwbNR4ILAAlVhQmGnRKPHELBAAWDSoAGTM0GgI7DXMCECkRDT8JDC0CPzUeKgEKAy0REktjPj8VGhU+AHc/A0lKCDc2IhgUOGkVPC8aMDsiBikzFDMkKBAiLAc8Nh80CzcCPC4aLBIpKCUnECobFl4DCTsFHgkqMnIqBy47IQ0HPSkSLzoSPiQCEz4DJC8EFEobJQA9KRI8OQA5BRoePTkCJAcqPA8tPTkbASgpXUgBOAMANxAmYDk4cDQyHhYVNwkqGXYmAz09EDoDHDsuGgEdP24vGRwWO0tjOiwWNBIgMnsFFSkwGwgUDygBBToKOwUKNz4XLzYyHyAJCActPwE7PUErAjcUMAMWNgQuMxQgFDk9IAUTTik0PwI8MgU7dxIJLAAhRRkZCAggGSJXMBQrAQ
IP
0.0.0.0:0
ASN
#0

Requested by
https://stownrusis.com/s?DxAf

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /Q25ReHoiDDIVRSJTM14PMQJsXUgFS2M+HjELaUkWOR4oSAl0H38bFiwbNR4ILAAlVhQmGnRKPHELBAAWDSoAGTM0GgI7DXMCECkRDT8JDC0CPzUeKgEKAy0REktjPj8VGhU+AHc/A0lKCDc2IhgUOGkVPC8aMDsiBikzFDMkKBAiLAc8Nh80CzcCPC4aLBIpKCUnECobFl4DCTsFHgkqMnIqBy47IQ0HPSkSLzoSPiQCEz4DJC8EFEobJQA9KRI8OQA5BRoePTkCJAcqPA8tPTkbASgpXUgBOAMANxAmYDk4cDQyHhYVNwkqGXYmAz09EDoDHDsuGgEdP24vGRwWO0tjOiwWNBIgMnsFFSkwGwgUDygBBToKOwUKNz4XLzYyHyAJCActPwE7PUErAjcUMAMWNgQuMxQgFDk9IAUTTik0PwI8MgU7dxIJLAAhRRkZCAggGSJXMBQrAQ HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

pogothere.xyz/

188.114.97.1

200 OK

26 B

URL GET HTTP/2
pogothere.xyz/
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectpogothere.xyz
Fingerprint34:D3:33:F8:49:E2:1E:3E:44:A8:5D:74:68:9C:B8:A0:D5:F8:DD:0B
ValidityWed, 27 Mar 2024 02:15:30 GMT - Tue, 25 Jun 2024 02:15:29 GMT

File type
ASCII text, with no line terminators
Size
26 B (26 bytes)
Hash
8c3f9083f7dc61deabe0d72f520b2d7d
77b1e046e2a415e524681592a6bd29e96c8236f9
bf9ea06c7b8c9ea6638dd8db03f9a4b3b270f9f4907a7b422d954e872f56ab5f

HTTP Headers

GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 07 May 2024 17:35:06 GMT
content-type: text/plain
set-cookie: csu=154252498621809@1@1715103306; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://stownrusis.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NgDS6ZE9O2bbrMKjo3LR7doSHYlg4%2BDut69FOXuonOo7%2BwaIku75F45gmp25rGFGCMHnCdNC6gBXfSyMXxWvF4rh24UsrJjppSesn9PfslCAIkacc3NfnZV2smiSiiAP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8802f6eef970b4fa-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

pogothere.xyz/asd100.bin

188.114.97.1

200 OK

102 kB

URL GET HTTP/2
pogothere.xyz/asd100.bin
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectpogothere.xyz
Fingerprint34:D3:33:F8:49:E2:1E:3E:44:A8:5D:74:68:9C:B8:A0:D5:F8:DD:0B
ValidityWed, 27 Mar 2024 02:15:30 GMT - Tue, 25 Jun 2024 02:15:29 GMT

File type
data
Size
102 kB (102400 bytes)
Hash
4c6426ac7ef186464ecbb0d81cbfcb1e
5a6918eebd9d635e8f632e3ef34e3792b1b5ec13
f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16

HTTP Headers

GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 07 May 2024 17:35:06 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://stownrusis.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 1432
last-modified: Tue, 07 May 2024 17:11:14 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TtKs9DQEXPfZr%2BiBw%2F%2BG6OpzpfC5mOWSkZYkqdE0Dm6YvpMbTtsmLWzH2RSw738T8BV6fHTi34lD3bJP2umvx3YLo5oJ4OOqJWR2M5Is01gH9XjvUruIlDpxOsetrFdd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8802f6eef968b4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap

142.250.74.106

200 OK

14 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79
ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT

File type
ASCII text
Size
14 kB (14029 bytes)
Hash
9c12b57a25710853b762d48b28545b5c
57a79d40792f42232b317bd9529c98efa29fc315
35ae53cd6f0cde71e622f6e54dc576bb82ffab56c9e41b1298f932eebf963eb9

HTTP Headers

GET /css2?family=Roboto:wght@100;300;400;500;700;900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 07 May 2024 17:35:05 GMT
date: Tue, 07 May 2024 17:35:05 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

stownrusis.com/favicon.ico

188.114.96.1

404 Not Found

561 B

URL GET HTTP/3
stownrusis.com/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?DxAf
Certificate
IssuerGoogle Trust Services LLC
Subjectstownrusis.com
Fingerprint30:C8:89:AC:75:9B:91:EB:F9:13:4C:D7:D0:72:E4:2F:8B:B7:87:39
ValiditySun, 31 Mar 2024 11:48:50 GMT - Sat, 29 Jun 2024 11:48:49 GMT

File type
HTML document, ASCII text, with very long lines (587), with no line terminators
Size
561 B (561 bytes)
Hash
ef8067f570d910ccebdf42ffc755bf66
da4084be4933ddc66d1727f38bc514ae15de91fc
1b386e7e1b13d52f377ab22266d9973bc86452bd70e58db468d7369b46a8ed46

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: stownrusis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/s?DxAf
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Tue, 07 May 2024 17:35:05 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 20
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vy34i5%2F23LoK7GIpUGFHqtDCPavjCSmDJQWQRkmDGNxD6n5hVRqejvOnrlmfADa7TRXuS9BHEhDiQHhfwGdxkT5F6RnJ0K15l4KHjDjEcIpx7eJwph5jRKVZQffdvO5NOA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8802f6ebeff6712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

stownrusis.com/s?DxAf

188.114.96.1

200 OK

96 kB

URL User Request GET HTTP/2
stownrusis.com/s?DxAf
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectstownrusis.com
Fingerprint30:C8:89:AC:75:9B:91:EB:F9:13:4C:D7:D0:72:E4:2F:8B:B7:87:39
ValiditySun, 31 Mar 2024 11:48:50 GMT - Sat, 29 Jun 2024 11:48:49 GMT

File type
HTML document, ASCII text, with very long lines (61184)
Size
96 kB (95490 bytes)
Hash
86f21e5a3025592aae47f989382b4d4b
d8cefba5632d65fae42a5c8c571347c8826222d2
3efd06cdf0d8de74a5a472f14f98a228bc1a6f68b451346be0f6f2b83aebddfd

HTTP Headers

GET /s?DxAf HTTP/1.1
Host: stownrusis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 07 May 2024 17:35:05 GMT
content-type: text/html
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eng7F2KrmzAuiTnVX35SLZ9nznRk4C9T7gpeKNGHI6Rz1yYAm9KnYxWqqUBSnyxtnrvibAopzX%2FWgsKfL2IVT5pColeF9JSTnDKwhBxQ3jF7lm%2Fyr2FsHsSdnEaeG%2BLZXw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8802f6e8af5656c5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate