WEBSITE ANALYSIS REPORT

http://c96ryrm.pages.dev/

21 Aug 2026 · 19:50:54.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

c96ryrm.pages.dev2 captured requests
cdn.redgarto.com6 captured requests
cdn.show-creative1.com1 captured requests
cdn.storageimagedisplay.com19 captured requests
consumeririssalary.com36 captured requests
exemplarfederallithe.com9 captured requests
fizzyacerbitymellow.com1 captured requests
flushpersist.com2 captured requests
fonts.googleapis.com1 captured requests
fonts.gstatic.com2 captured requests
go.realus.lt2 captured requests
kettledroopingcontinuation.com12 captured requests
mamshirt.com1 captured requests
portalfluently.com2 captured requests
protrafficinspector.com4 captured requests
racingorchestra.com6 captured requests
sowve.com1 captured requests
static.nresystems.com1 captured requests
wingsmob.com3 captured requests

Connections

c96ryrm.pages.dev → cdn.redgarto.comCalls3 captured connections
c96ryrm.pages.dev → cdn.redgarto.comLoads from3 captured connections
c96ryrm.pages.dev → cdn.show-creative1.comCalls1 captured connections
c96ryrm.pages.dev → cdn.storageimagedisplay.comLoads from19 captured connections
c96ryrm.pages.dev → consumeririssalary.comCalls4 captured connections
c96ryrm.pages.dev → consumeririssalary.comLoads from32 captured connections
c96ryrm.pages.dev → exemplarfederallithe.comCalls1 captured connections
c96ryrm.pages.dev → exemplarfederallithe.comLoads from8 captured connections
c96ryrm.pages.dev → fizzyacerbitymellow.comLoads from1 captured connections
c96ryrm.pages.dev → flushpersist.comLoads from2 captured connections
c96ryrm.pages.dev → fonts.googleapis.comLoads from1 captured connections
c96ryrm.pages.dev → fonts.gstatic.comLoads from2 captured connections
c96ryrm.pages.dev → go.realus.ltLoads from2 captured connections
c96ryrm.pages.dev → kettledroopingcontinuation.comCalls4 captured connections
c96ryrm.pages.dev → kettledroopingcontinuation.comLoads from8 captured connections
c96ryrm.pages.dev → mamshirt.comLoads from1 captured connections
c96ryrm.pages.dev → portalfluently.comLoads from2 captured connections
c96ryrm.pages.dev → protrafficinspector.comCalls4 captured connections
c96ryrm.pages.dev → racingorchestra.comLoads from6 captured connections
c96ryrm.pages.dev → sowve.comCalls1 captured connections
c96ryrm.pages.dev → static.nresystems.comLoads from1 captured connections
c96ryrm.pages.dev → wingsmob.comCalls2 captured connections
c96ryrm.pages.dev → wingsmob.comLoads from1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

19:50:22.881 GET 200 document 20.3 KB 283 ms —

19:50:23.537 GET 200 script 77.5 KB 170 ms 1 alerts

19:50:23.539 GET 200 script 32.3 KB 402 ms 1 alerts

19:50:23.540 GET 200 script 32.2 KB 182 ms 1 alerts

19:50:23.542 GET 200 script 32.2 KB 179 ms 1 alerts

19:50:23.543 GET 200 script 32.2 KB 404 ms 1 alerts

19:50:23.544 GET 200 script 94.8 KB 177 ms 1 alerts

19:50:23.546 GET No response script 0 B 0 ms —

19:50:23.767 GET 200 script 83.4 KB 111 ms 1 alerts

19:50:23.769 GET 200 xhr 40 B 93 ms —

19:50:23.772 GET 200 img 0 B 105 ms 3 alerts

19:50:23.774 GET 200 script 83.4 KB 106 ms 1 alerts

19:50:23.775 GET 200 xhr 40 B 99 ms —

19:50:23.777 GET 200 script 4.2 KB 63 ms —

19:50:23.780 GET No response script 0 B 0 ms —

19:50:23.798 GET 200 xhr 40 B 101 ms —

19:50:23.800 GET 200 xhr 14.1 KB 494 ms 1 alerts

19:50:23.802 GET 200 xhr 40 B 89 ms —

19:50:23.804 GET 200 xhr 14.2 KB 395 ms 1 alerts

19:50:23.858 GET 200 xhr 14.1 KB 393 ms 1 alerts

19:50:23.859 GET 200 xhr 14.2 KB 380 ms 1 alerts

Transaction #58

Request / response

URL

GET HTTPS

https://consumeririssalary.com/ntv.json?key=9bb1e723dfbb9b4b72f7e607ef03f101&vstc=4&rb=e

IP / ASN

172.240.108.84

AS7979 · SERVERS-COM

Requested by: https://c96ryrm.pages.dev/

Resource information

File type: JSON text data
MIME type: application/json
First seen (UTC): 21 Aug 2026 · 19:50:59.202 UTC
Last seen (UTC): 21 Aug 2026 · 19:50:59.202 UTC
Times seen: 1

Size: 14.2 KB (14517 bytes)
MD5: 122bc09f3e4aa191c04c80d6ebb2ef8b
SHA1: 98e4b375f0c67981b58eeeea69cdab8a18690f33
SHA256: b3c82307c3f21679b5b60088078135ddbfa0b2266f3a74f74ebf94f8ea168af4

Certificate information

Issuer: Let's Encrypt · YR2
Subject: consumeririssalary.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 08:DF:6C:56:C6:6F:E6:A3:44:16:B8:61:3C:95:40:43:8F:27:B5:CD
Valid from: Thu, 25 Jun 2026 21:03:34 GMT
Valid until: Wed, 23 Sep 2026 21:03:33 GMT

Technology fingerprints

Envoy (Reverse proxies)
HSTS (Security)
Nginx:1.28.2 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /ntv.json?key=9bb1e723dfbb9b4b72f7e607ef03f101&vstc=4&rb=e HTTP/1.1
Host: consumeririssalary.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://c96ryrm.pages.dev/
Origin: https://c96ryrm.pages.dev
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.28.2
Date: Fri, 21 Aug 2026 19:50:24 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
accept-ch: Sec-Ch-Ua-Platform,Sec-Ch-Ua-Model,Sec-Ch-Ua-Mobile,User-Agent,Sec-Ch-Ua-Platformuser-Agent,Sec-Ch-Ua-Full-Version,Device-Stock-Ua,X-Device-User-Agent,X-Operamini-Phone-Ua,X-Ucbrowser-Device-Ua,Sec-Ch-Ua-Platform-Version,Sec-Ch-Ua,Sec-Ch-Ua-Full-Version-List
access-control-allow-credentials: true
access-control-allow-origin: https://c96ryrm.pages.dev
content-encoding: zstd
set-cookie: pdhtkv=true; Path=/; Expires=Sat, 22 Aug 2026 19:50:24 GMT; Secure; SameSite=None
uncs=1; Path=/; Expires=Sat, 22 Aug 2026 19:50:24 GMT; Secure; SameSite=None
pdhtkv49=true; Path=/; Expires=Sat, 22 Aug 2026 19:50:24 GMT; Secure; SameSite=None
uncs49=1; Path=/; Expires=Sat, 22 Aug 2026 19:50:24 GMT; Secure; SameSite=None
u_pl15470580=1; Path=/; Expires=Sat, 22 Aug 2026 19:50:24 GMT; Secure; SameSite=None
vary: Accept-Encoding
x-envoy-upstream-service-time: 10
Host: consumeririssalary.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 908a8e8b5aded455f582d306d0fccd4a
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

19:50:23.951 GET 200 xhr 14.7 KB 607 ms 1 alerts

19:50:23.953 GET 200 script 90.2 KB 72 ms —

19:50:23.956 GET 200 img 0 B 488 ms —

19:50:24.050 POST 200 fetch 0 B 140 ms —

19:50:24.053 GET 200 img 0 B 0 ms —

19:50:24.057 GET 200 xhr 76 B 93 ms —

19:50:24.211 GET 200 img 15.8 KB 313 ms —

19:50:24.212 GET 200 img 23.1 KB 310 ms —

19:50:24.214 GET 200 img 16.6 KB 87 ms —

19:50:24.217 GET 200 img 41.4 KB 130 ms —

19:50:24.221 GET 200 img 0 B 0 ms 1 alerts

19:50:24.222 GET 200 img 0 B 0 ms 1 alerts

19:50:24.223 GET 200 img 0 B 0 ms 1 alerts

19:50:24.224 GET 200 img 0 B 0 ms 1 alerts

19:50:24.225 GET 200 img 0 B 0 ms 1 alerts

19:50:24.226 GET 200 img 0 B 0 ms 1 alerts

19:50:24.227 GET 200 img 0 B 0 ms 1 alerts

19:50:24.228 GET 200 img 0 B 0 ms 1 alerts

19:50:24.247 GET 200 img 20.4 KB 91 ms —

19:50:24.248 GET 200 img 17.5 KB 59 ms —

19:50:24.249 GET 200 img 136.9 KB 137 ms —

19:50:24.256 GET 200 img 0 B 0 ms 1 alerts

19:50:24.257 GET 200 img 0 B 0 ms 1 alerts

19:50:24.259 GET 200 img 0 B 0 ms 1 alerts

19:50:24.260 GET 200 img 0 B 0 ms 1 alerts

19:50:24.261 GET 200 img 0 B 0 ms 1 alerts

19:50:24.262 GET 200 img 0 B 0 ms 1 alerts

19:50:24.264 GET 200 img 0 B 0 ms 1 alerts

19:50:24.265 GET 200 img 0 B 0 ms 1 alerts

http://c96ryrm.pages.dev/

Domain graph

Hostnames

Connections

Network requests

Transaction #58

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://c96ryrm.pages.dev/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #58

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://c96ryrm.pages.dev/

Domain graph

Network requests