WEBSITE ANALYSIS REPORT

http://fsx.monster/wf/wcetqvdxasrz/zt0rdw82xkzn/WURROUYzd0RHcFIyR0xWUkM5Qnp6Zz09

09 Nov 2025 · 08:40:42.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

4.adsco.re2 captured requests
6.adsco.re2 captured requests
7ai2lewknnug.l4.adsco.re1 captured requests
7ai2lewknnug.n4.adsco.re1 captured requests
7ai2lewknnug.s4.adsco.re1 captured requests
acacdn.com2 captured requests
adexchangeclear.com1 captured requests
adsco.re1 captured requests
c.adsco.re1 captured requests
cdn.show-sb.com1 captured requests
challenges.cloudflare.com6 captured requests
creative-sb1.com6 captured requests
dogcollarfavourbluff.com6 captured requests
flexy.stream34 captured requests
flushpersist.com2 captured requests
fsx.monster1 captured requests
fx-004.host-cdn.net4 captured requests
gmxvmvptfm.com4 captured requests
intellipopup.com1 captured requests
preferencenail.com2 captured requests
professionaltrafficmonitor.com2 captured requests
skinnycrawlinglax.com4 captured requests
torchfriendlypay.com2 captured requests
usrpubtrk.com1 captured requests
weirdopt.com1 captured requests
www.gstatic.com1 captured requests
www.intellipopup.com1 captured requests

Connections

flexy.stream → 4.adsco.reCalls2 captured connections
flexy.stream → 6.adsco.reCalls2 captured connections
flexy.stream → 7ai2lewknnug.l4.adsco.reCalls1 captured connections
flexy.stream → 7ai2lewknnug.n4.adsco.reCalls1 captured connections
flexy.stream → 7ai2lewknnug.s4.adsco.reCalls1 captured connections
flexy.stream → acacdn.comLoads from2 captured connections
flexy.stream → adexchangeclear.comCalls1 captured connections
flexy.stream → adsco.reCalls1 captured connections
flexy.stream → c.adsco.reEmbeds1 captured connections
flexy.stream → cdn.show-sb.comCalls1 captured connections
flexy.stream → challenges.cloudflare.comEmbeds1 captured connections
flexy.stream → challenges.cloudflare.comLoads from1 captured connections
flexy.stream → creative-sb1.comCalls3 captured connections
flexy.stream → creative-sb1.comLoads from3 captured connections
flexy.stream → dogcollarfavourbluff.comCalls1 captured connections
flexy.stream → dogcollarfavourbluff.comLoads from5 captured connections
flexy.stream → flushpersist.comLoads from2 captured connections
flexy.stream → fx-004.host-cdn.netCalls3 captured connections
flexy.stream → fx-004.host-cdn.netLoads from1 captured connections
flexy.stream → gmxvmvptfm.comCalls1 captured connections
flexy.stream → gmxvmvptfm.comEmbeds1 captured connections
flexy.stream → gmxvmvptfm.comLoads from2 captured connections
flexy.stream → intellipopup.comLoads from1 captured connections
flexy.stream → preferencenail.comLoads from2 captured connections
flexy.stream → professionaltrafficmonitor.comCalls2 captured connections
flexy.stream → skinnycrawlinglax.comLoads from4 captured connections
flexy.stream → torchfriendlypay.comLoads from2 captured connections
flexy.stream → usrpubtrk.comCalls1 captured connections
flexy.stream → weirdopt.comLoads from1 captured connections
flexy.stream → www.gstatic.comLoads from1 captured connections
flexy.stream → www.intellipopup.comLoads from1 captured connections
fsx.monster → flexy.streamRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

08:40:16.320 GET 302 document 7.3 KB 569 ms —

08:40:16.645 GET 403 document 7.3 KB 104 ms 1 alerts

08:40:16.811 GET 301 document 6.7 KB 26 ms 1 alerts

08:40:16.838 GET 403 document 6.7 KB 27 ms 1 alerts

08:40:16.942 GET 200 script 122.2 KB 18 ms —

08:40:16.963 GET 200 img 1.1 KB 68 ms —

08:40:17.000 GET 200 img 1.1 KB 32 ms —

08:40:17.005 GET 200 script 48.3 KB 41 ms —

08:40:17.206 POST 200 xhr 15.8 KB 19 ms —

08:40:17.321 GET 200 subdocument 179.1 KB 16 ms —

08:40:17.391 GET 200 img 86 B 10 ms —

08:40:17.728 POST 200 xhr 207.3 KB 66 ms —

08:40:18.277 GET 200 img 418 B 13 ms —

08:40:19.835 GET 401 fetch 1 B 9 ms —

08:40:21.498 POST 200 xhr 4.1 KB 81 ms —

08:40:21.633 POST 200 document 13.7 KB 229 ms 1 alerts

08:40:21.952 GET 200 stylesheet 48.2 KB 68 ms —

08:40:21.955 GET 200 script 87.4 KB 109 ms —

08:40:21.956 GET 200 script 10.5 KB 67 ms —

08:40:21.960 GET 200 img 5.0 KB 67 ms —

08:40:21.962 GET 200 script 4.2 KB 66 ms —

08:40:21.963 GET 200 script 153.0 KB 129 ms 2 alerts

08:40:21.964 GET 200 script 104.2 KB 852 ms 2 alerts

08:40:21.965 GET 200 script 83.0 KB 839 ms 2 alerts

08:40:21.966 GET 200 script 58.5 KB 103 ms —

08:40:21.966 GET 200 stylesheet 44.3 KB 93 ms —

08:40:21.968 GET 200 stylesheet 1.9 KB 93 ms —

08:40:21.969 GET 200 script 551.9 KB 109 ms —

08:40:21.970 GET 200 script 4.4 KB 96 ms —

08:40:21.971 GET 200 script 2.0 KB 68 ms —

08:40:21.972 GET 200 stylesheet 2.5 KB 67 ms —

08:40:21.973 GET 200 script 31.0 KB 97 ms —

08:40:21.974 GET 200 script 141.8 KB 73 ms —

08:40:21.975 GET 200 stylesheet 1.8 KB 66 ms —

08:40:21.977 GET 200 script 4.2 KB 121 ms —

08:40:21.978 GET 200 script 5.5 KB 94 ms —

08:40:21.980 GET 200 script 6.0 KB 64 ms —

08:40:21.980 GET 200 stylesheet 332 B 93 ms —

08:40:22.161 GET 200 img 4.2 KB 64 ms —

08:40:22.165 GET 200 img 14.8 KB 119 ms —

08:40:22.438 GET 200 subdocument 926 B 17 ms 2 alerts

08:40:22.442 GET 200 script 41.0 KB 120 ms —

08:40:22.514 GET 200 img 0 B 733 ms 3 alerts

08:40:22.518 GET 200 script 6.3 KB 722 ms 3 alerts

08:40:22.539 GET 200 script 83.4 KB 164 ms 3 alerts

08:40:22.541 GET 200 xhr 40 B 454 ms —

08:40:22.552 GET 200 script 83.4 KB 230 ms 3 alerts

Transaction #50

Request / response

URL

GET HTTPS

https://preferencenail.com/sfp.js

IP / ASN

185.196.197.71

AS39572 · DataWeb Global Group B.V.

Requested by: https://flexy.stream/zt0rdw82xkzn/WURROUYzd0RHcFIyR0xWUkM5Qnp6Zz09

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
MIME type: application/javascript; charset=utf-8
First seen (UTC): 08 Jul 2025 · 10:38:39.799 UTC
Last seen (UTC): 07 Jul 2026 · 20:05:43.095 UTC
Times seen: 15231

Size: 83.4 KB (85386 bytes)
MD5: 46a6fef91632b94d14252fe324c1585f
SHA1: 387cebbd261b8fe947fe9805875300f2ceeb5cfd
SHA256: 36d0c771f8bf310d740cb4d0ca144354c45df284e72361660448708d72f175d5

Certificate information

Issuer: Let's Encrypt · R12
Subject: preferencenail.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: AA:22:33:AC:0A:FC:0D:31:C5:9F:92:99:20:7A:02:E4:46:E3:08:8C
Valid from: Wed, 29 Oct 2025 23:40:35 GMT
Valid until: Tue, 27 Jan 2026 23:40:34 GMT

Technology fingerprints

Nginx:1.21.6 (Web servers, Reverse proxies)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Cloudflare DNS Sinkholed	medium	Malicious
DNS4EU Sinkholed	medium	Malicious
Hagezi Threat Feed Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /sfp.js HTTP/1.1
Host: preferencenail.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://flexy.stream/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sun, 09 Nov 2025 08:40:22 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 32182
Connection: keep-alive
Content-Encoding: gzip
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Host: preferencenail.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 74ef00f156c52879e216b861ad13cf2e
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

08:40:22.556 GET 200 xhr 40 B 443 ms —

08:40:22.557 GET 200 script 23.9 KB 19 ms —

08:40:22.766 GET 200 fetch 1.3 KB 275 ms 1 alerts

http://fsx.monster/wf/wcetqvdxasrz/zt0rdw82xkzn/WURROUYzd0RHcFIyR0xWUkM5Qnp6Zz09

Domain graph

Hostnames

Connections

Network requests

Transaction #50

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://fsx.monster/wf/wcetqvdxasrz/zt0rdw82xkzn/WURROUYzd0RHcFIyR0xWUkM5Qnp6Zz09

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #50

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://fsx.monster/wf/wcetqvdxasrz/zt0rdw82xkzn/WURROUYzd0RHcFIyR0xWUkM5Qnp6Zz09

Domain graph

Network requests