| flowhot.cc/wp-content/uploads/2019/11/promo.jpeg |  172.67.165.215 | 200 OK | 161 kB |
URL GET HTTP/2flowhot.cc/wp-content/uploads/2019/11/promo.jpeg IP172.67.165.215:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Macintosh), datetime=2019:11:21 20:13:11], progressive, precision 8, 900x250, components 3 Size161 kB (160863 bytes) Hashf66cbb86803abd9d9f37a1588f14d5fd c38f678cea2edc798d223b0c57f3b6c6b4acb008 ee089d909a7461ab0f483151883331e191c18f0a1db138a4bba12d82330287a1
GET /wp-content/uploads/2019/11/promo.jpeg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: image/jpeg
content-length: 160863
cache-control: public, max-age=31536000
expires: Sun, 26 May 2024 20:36:52 GMT
last-modified: Fri, 22 Nov 2019 02:34:58 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 3546
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YlBS%2FABF%2FO8Cc%2F%2Bl8gitM2BgTwCxYcTF4QkvX0xW%2Fvb7nCPNcQR%2FL7t2BNMnnTiB5ZWuSM2y%2Ff3hDlwj2Gqdew%2B9cbbJh67g8jbxiuTeUbf14HRGXufb6JYtFcHz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4a4f8cc5693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| code.jquery.com/jquery-3.4.1.js | 151.101.2.137 | 200 OK | 83 kB |
URL GET HTTP/2code.jquery.com/jquery-3.4.1.js IP151.101.2.137:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text Hash11c05eb286ed576526bf4543760785b9 7faa15a054093f3b5d674e63b6567c835a6fa217 5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
GET /jquery-3.4.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4472c"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 26 Apr 2024 21:35:58 GMT
age: 19366608
x-served-by: cache-lga21923-LGA, cache-hel1410032-HEL
x-cache: HIT, HIT
x-cache-hits: 22, 128895
x-timer: S1714167358.256841,VS0,VE0
vary: Accept-Encoding
content-length: 82889
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=UA-922266-5 | 142.250.74.168 | 200 OK | 73 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=UA-922266-5 IP142.250.74.168:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52 ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT
File typeJavaScript source, ASCII text, with very long lines (4179) Hashf4f1348a36de5b5a5596512796120c6c 34b5cddebb199edc2f46c51a9b541177ac1f3636 16ec0009b5324810038e67aa5cf74423f95241830352aede79f38df597af43cb
GET /gtag/js?id=UA-922266-5 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 21:35:58 GMT
expires: Fri, 26 Apr 2024 21:35:58 GMT
cache-control: private, max-age=900
last-modified: Fri, 26 Apr 2024 21:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 73173
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| flowhot.cc/wp-content/uploads/2024/04/La%20Mas%20Doll%20Ft.%20Ceky%20Viciny%20-%20La%20Del%20Proceso-300x300.jpg | 172.67.165.215 | 200 OK | 28 kB |
URL GET HTTP/2flowhot.cc/wp-content/uploads/2024/04/La%20Mas%20Doll%20Ft.%20Ceky%20Viciny%20-%20La%20Del%20Proceso-300x300.jpg IP172.67.165.215:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 300x300, components 3 Hash8243497397f3388a1b1b702ab44ce680 50732194d0a923d28ef03dec24745f6be47193fa 138fe6ec7547b448d3fa1963847e21c41e64ab2d179a0cd415b50eadd6c676a9
GET /wp-content/uploads/2024/04/La%20Mas%20Doll%20Ft.%20Ceky%20Viciny%20-%20La%20Del%20Proceso-300x300.jpg HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: image/jpeg
content-length: 27682
cache-control: public, max-age=31536000
expires: Sun, 26 May 2024 21:35:58 GMT
last-modified: Mon, 08 Apr 2024 22:33:37 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGVCe1f7BO1rAM1hWPDY0BpeMkziB93jOx1bncQ5UCZlwz0d1UpXqK0HjEweb4fKclzlp8zgznjgRxRh9be6TVBe92R2yDnXuvPh8NMYGBKDlOfaLdAGmsrUOyK5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4a4f8ca5693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c | 142.250.74.168 | 200 OK | 89 kB |
URL GET HTTP/3www.googletagmanager.com/gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c IP142.250.74.168:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subject*.google-analytics.com FingerprintFC:B1:16:E0:D8:F3:2B:F3:AB:33:E5:E1:23:57:F4:48:66:FD:4D:52 ValidityMon, 08 Apr 2024 06:34:55 GMT - Mon, 01 Jul 2024 06:34:54 GMT
File typeJavaScript source, ASCII text, with very long lines (5945) Hash446ce8715ee320a7254dd0d1c58202a5 85b15bf3de9be427acd3112a059d0858005edc25 b6e617c10a62cccfbea5a6d9fcfd8e96b8bcd7ddf7043e6ea5097c1307edd6ee
GET /gtag/js?id=G-Z7TJ1ZBHKC&l=dataLayer&cx=c HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 26 Apr 2024 21:35:58 GMT
expires: Fri, 26 Apr 2024 21:35:58 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 88751
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js | 192.243.61.225 | 200 OK | 16 kB |
URL GET HTTP/1.1finallytrained.com/06/33/56/0633569b5e7b7ced877cf02d43663712.js IP192.243.61.225:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectfinallytrained.com Fingerprint51:0C:3D:8A:D3:C9:0A:92:4D:23:A2:75:D2:95:75:02:2E:DE:39:CE ValiditySun, 03 Mar 2024 06:48:00 GMT - Sat, 01 Jun 2024 06:47:59 GMT
File typeJavaScript source, ASCII text, with very long lines (44112), with no line terminators Hash7385a80e8d7934af6c054c3aabf4fbac 54da22e4d50cabe019457c91194161563f19d80e 5416f1b6ee41a9f7bc473be46c5b3154d21cb73dc386659386618df9c6120728
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /06/33/56/0633569b5e7b7ced877cf02d43663712.js HTTP/1.1
Host: finallytrained.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:35:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 26587c25d2bb6ebd002b410b2d8f5e08
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| 661212.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js |  188.114.96.1 | 200 OK | 1.2 kB |
URL GET HTTP/3661212.flowhot.cc/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js IP188.114.96.1:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typegzip compressed data, from Unix Hash6aa6a10b9eaee361bd09c167a1b82c52 ba03d67ce64df5ce5267628be16c178b137fa616 0da477c3b9227c0dddd690f4fe626945040a85ee9c848fcc6c6bb9045e6a6f84
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: application/javascript
last-modified: Fri, 19 Apr 2024 20:54:07 GMT
etag: W/"6622d9ef-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SJqOYWh%2BBpbeTxd1yR1COrzM6YfHjB058dlvOI31yi72OsvKAlpC7bVTnOneFJ8nq68RsZ9Ci%2BWAn7z4q7TxVaZqFKFZLJRKek1%2B7wsvdMFK7uDqByHB2Ts0brfF4zDBdb5S0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4a4dd9156c6-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Sun, 28 Apr 2024 21:35:58 GMT
cache-control: max-age=172800, public
content-encoding: gzip
|
|
| 661212.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js | 188.114.96.1 | 200 OK | 13 kB |
URL GET HTTP/3661212.flowhot.cc/cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js IP188.114.96.1:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeJavaScript source, ASCII text, with very long lines (858) Hash60f5b7288354db3bf85bdb6f0f7823e4 4b3cd1fec98d9c997df4bf4f39ef9fdc796d6c67 1aa4afd6f61c0a3f4bedab7497625c81da7571c73f5e8d6b0d7984b861d79de8
GET /cdn-cgi/apps/head/hWKZRCl_p5W3AeulawGLi1ghRvM.js HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: application/javascript; charset=utf-8
x-amz-id-2: P/7etxh5SYcpisapLoHA4Sl+fZIlctlxG7TWj1jkOJUXivENJIPpKWjc8ZJP6snkEBH8XyZr8e4=
x-amz-request-id: 35T49ZWTHZYCX3HT
cache-control: public, max-age=31536000
last-modified: Wed, 11 Dec 2019 13:31:58 GMT
x-amz-version-id: ESUrlvQQwNmPgiI2n2eMDNt6te85sX_N
etag: W/"ceb291a94a4e29bc8fe20512e46d29e3"
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YttOAwjG9NhjqtM21ofpwENLwo9oXbIx%2BOmP4bdK5Yg9rbBXG0fHch84TXoDnbduBv%2FXQ8HbTWN0eG%2FiXiV7fJl6IYVoAoViit%2F0pjDHCo2ozWTM%2BuMvYLSIvJYxjRfkl5wJaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4a4cd7456c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| proftrafficcounter.com/stats |  18.159.11.169 | 200 OK | 40 B |
URL GET HTTP/2proftrafficcounter.com/stats IP18.159.11.169:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerAmazon Subjectproftrafficcounter.com FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6 ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT
File typeASCII text, with no line terminators Hasheaf7141b0500f4e8a9a81d2277c4c83f f69ba5edb78a876512734249e41869a1fb6be2bc 59246aa70a52cf877eb333a00314a7124e836540ad8805341ed39b58b0139318
GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://661212.flowhot.cc
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; expires=Mon, 24 Apr 2034 21:35:59 GMT; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 |  104.18.10.207 | 200 OK | 77 kB |
URL GET HTTP/3maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 IP104.18.10.207:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectbootstrapcdn.com Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63 ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 77160, version 4.459 Hashaf7ae505a9eed503f8b8e6982036873e d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
GET /font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://maxcdn.bootstrapcdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: font/woff2
content-length: 77160
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "af7ae505a9eed503f8b8e6982036873e"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 19:08:24
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 752
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: c46b8896260fac28e5a12d7f5b0f3373
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a9b4ac3c65b511-OSL
alt-svc: h3=":443"; ma=86400
|
|
| maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 | 104.18.10.207 | 200 OK | 18 kB |
URL GET HTTP/3maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 IP104.18.10.207:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectbootstrapcdn.com Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63 ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 18028, version 1.589 Hash448c34a56d699c29117adc64c43affeb ca35b697d99cae4d1b60f2d60fcd37771987eb07 fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
GET /bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2 HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: font/woff2
content-length: 18028
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: "448c34a56d699c29117adc64c43affeb"
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
cdn-cachedat: 09/21/2023 16:48:19
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 1053
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 41ab482e39d1ebfaaa33c78008a55a64
cdn-cache: HIT
cf-cache-status: MISS
accept-ranges: bytes
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a9b4ac6c7eb511-OSL
alt-svc: h3=":443"; ma=86400
|
|
| notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.4 |  139.45.197.253 | 200 OK | 318 B |
URL GET HTTP/2notix.io/settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.4 IP139.45.197.253:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectnotix.io Fingerprint3C:56:70:26:73:9D:43:E7:28:EF:40:FE:65:98:CD:7B:0A:56:D9:1B ValiditySat, 17 Feb 2024 20:57:19 GMT - Fri, 17 May 2024 20:57:18 GMT
Hash82b0c0f76512e60ea030da09ee18febf 2c4b11e5713c2f7e6a3da2ef87a1c0c78c3da195 a8ca49249ca90a131bba14405671cb243da2849145a3d8074b0b5c232c2b57d1
GET /settings?appId=1004ce02062614f98c25893fe046136&ver=0.16.4 HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://661212.flowhot.cc/
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: application/json; charset=utf-8
content-length: 318
access-control-allow-origin: https://661212.flowhot.cc
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
|
|
| flowhot.cc/wp-content/themes/flowhot/style.css?ver=1714128935 | 172.67.165.215 | 200 OK | 38 kB |
URL GET HTTP/2flowhot.cc/wp-content/themes/flowhot/style.css?ver=1714128935 IP172.67.165.215:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeASCII text, with very long lines (4468) Hash4c1717ce0a000bdbf8af2b620be2b465 9398d9ac4a1f37374cc187f5a1e3d6dc69f2a208 25f469c98011ebbf04fe876c4a5732b88c74bf48dfc6b03f8fa7d68b34657404
GET /wp-content/themes/flowhot/style.css?ver=1714128935 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Sun, 26 May 2024 21:35:58 GMT
last-modified: Fri, 19 Jun 2020 18:37:30 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DCP2%2FPDSA9%2B5WIhlMOM3xenYTr7eLlr5fo3oNXzokoh5e%2BToZnmzBVpC0HOw%2BhHw0UzJlxkyq5iB3aBUs4xlg5DDlcPYtIOLsk5NYSF2ffUebQL7jC3wKG0JU4RB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a9b4a4f8cd5693-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| trebleuniversity.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce%3A2%3A1 | 172.240.108.84 | 200 OK | 7.6 kB |
URL GET HTTP/1.1trebleuniversity.com/sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce%3A2%3A1 IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashe06d51a46679c94a12e255139bc7a966 ae0ceea88771b906e9995639c27c59d2e39a5b3a b54e69ff4100be98a85479cb640fa6247e7c30aa99b2108926093b6ea8b59343
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /sbar.json?key=0633569b5e7b7ced877cf02d43663712&uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce%3A2%3A1 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:35:59 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://661212.flowhot.cc
Access-Control-Allow-Origin: https://661212.flowhot.cc
Access-Control-Allow-Credentials: true
Set-Cookie: u_pl=19408177; expires=Sat, 27 Apr 2024 21:35:59 GMT; secure; SameSite=None
uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; expires=Fri, 03 May 2024 21:35:59 GMT; secure; SameSite=None
pdhtkv=true; expires=Sat, 27 Apr 2024 21:35:59 GMT; secure; SameSite=None
uncs=1; expires=Sat, 27 Apr 2024 21:35:59 GMT; secure; SameSite=None
pdhtkv29=true; expires=Sat, 27 Apr 2024 21:35:59 GMT; secure; SameSite=None
uncs29=1; expires=Sat, 27 Apr 2024 21:35:59 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 643015f75987f177650ec1702862b4d0
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| trebleuniversity.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9P7pnzCEY40rImg2Jop6kuqpmttzqrqaqa3p2TosByXHYi9feb3azmATRizeD9AY8BIQdT3tw%2FwQvQs4y4%2BLoO9R73%2FtewVffq2%2F23RlpwtHTax%2FrsVSKrnUafv3i50Fwub4hUzeqj7rhl2H7ct0M3%2BuFDf%2Bd%2BkeCbeu1ph%2F4fuAH9XVpRF%2BP1uYkZPaoFzR6fqPdbASdNkbm%2F9g6D5Z64MMz8jIkn6088S5Asgpp8sM1YbdznV36MHGK5tpgyI8%2BTbdTXaRIlmXfeOinR%2BfT0PZk%2FTF0eriQCz38dzCWM%2BL9%2BhhxenQuEvHwYKEzVhApYv4CimEFoSpIWoHpu5D8hACM4%2BYm0uT%2BTW0KuvMPS%2BfsjKw8%2BwuymJGVPy4gTb6%2FquSofkcrl0udWoz6JeSoghxUyNwx8nENsjgGy7%2BG5L%2BRtWcbSJODTas0JD99sydo1I3a%2FioLBF1t94L%2Batzt0dVOwMJ20O3QkImFQVJWkP0KSkxAbQ3OenDSg%2Bt7cJmHhJ%2FWWRAEkc8Z9bs9xlo8EnHI%2FYBG%2FYAGftiFY%2FM3TJBnEzA1ATO7yMwutuUExv0Cu1XCcg82JxjyEoUgKCxBQQkKSVDkBMWwPOTKNm15nyvr4uA8N89zq5zqfLBPD3U%2BECkBNRMYXu5nZ%2BSluYHexbcCbIvTuh%2B2Wp2wF3dEFEdM8G4Usb7f5O1WGLaioAkrS0hbA7UexnJG3n5tBZk8eSVFTI9h1TGY9EDd66BFCbpVYpw%2BpONMKGkbTCfgukSWryDf8fbVGXl1sb8b3z6AYE%2FJeYCZEpkp8ZV8QjBQ96a3dUEObuvCkh83s1wmckznu72T01w8%2F%2BCG2Cm04dev2cl377M5MS8ffSJsvkFTLtOBJQ%2BvSs6FWdeGCfLzdfuZiG85u3XVmdRlG7c%2BWL%2BeZEZYK3VagcqTL%2FbA5Iy8%2BNPG4tO%2BW%2F8T0lQwrkTilkqlrsCyXdhs2bOawKgljjMPhSunphkvm0oSKLHENC5h%2F4PjZT01dH6bynLf3sPA1EDzu0iTEkNTYqhKUDWBdc9N88w8vfJ7axGIVW0aK1M7iJVRewuT58cerDytR62WT8NeJ4giKqK43ez2w4BT2myHzTCkLeR21r%2F0xpW%2FAQAA%2F%2F8BAAD%2F%2F%2Bp0O%2FeOBAAA | 172.240.108.84 | 200 OK | 7 B |
URL GET HTTP/1.1trebleuniversity.com/ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9P7pnzCEY40rImg2Jop6kuqpmttzqrqaqa3p2TosByXHYi9feb3azmATRizeD9AY8BIQdT3tw%2FwQvQs4y4%2BLoO9R73%2FtewVffq2%2F23RlpwtHTax%2FrsVSKrnUafv3i50Fwub4hUzeqj7rhl2H7ct0M3%2BuFDf%2Bd%2BkeCbeu1ph%2F4fuAH9XVpRF%2BP1uYkZPaoFzR6fqPdbASdNkbm%2F9g6D5Z64MMz8jIkn6088S5Asgpp8sM1YbdznV36MHGK5tpgyI8%2BTbdTXaRIlmXfeOinR%2BfT0PZk%2FTF0eriQCz38dzCWM%2BL9%2BhhxenQuEvHwYKEzVhApYv4CimEFoSpIWoHpu5D8hACM4%2BYm0uT%2BTW0KuvMPS%2BfsjKw8%2BwuymJGVPy4gTb6%2FquSofkcrl0udWoz6JeSoghxUyNwx8nENsjgGy7%2BG5L%2BRtWcbSJODTas0JD99sydo1I3a%2FioLBF1t94L%2Batzt0dVOwMJ20O3QkImFQVJWkP0KSkxAbQ3OenDSg%2Bt7cJmHhJ%2FWWRAEkc8Z9bs9xlo8EnHI%2FYBG%2FYAGftiFY%2FM3TJBnEzA1ATO7yMwutuUExv0Cu1XCcg82JxjyEoUgKCxBQQkKSVDkBMWwPOTKNm15nyvr4uA8N89zq5zqfLBPD3U%2BECkBNRMYXu5nZ%2BSluYHexbcCbIvTuh%2B2Wp2wF3dEFEdM8G4Usb7f5O1WGLaioAkrS0hbA7UexnJG3n5tBZk8eSVFTI9h1TGY9EDd66BFCbpVYpw%2BpONMKGkbTCfgukSWryDf8fbVGXl1sb8b3z6AYE%2FJeYCZEpkp8ZV8QjBQ96a3dUEObuvCkh83s1wmckznu72T01w8%2F%2BCG2Cm04dev2cl377M5MS8ffSJsvkFTLtOBJQ%2BvSs6FWdeGCfLzdfuZiG85u3XVmdRlG7c%2BWL%2BeZEZYK3VagcqTL%2FbA5Iy8%2BNPG4tO%2BW%2F8T0lQwrkTilkqlrsCyXdhs2bOawKgljjMPhSunphkvm0oSKLHENC5h%2F4PjZT01dH6bynLf3sPA1EDzu0iTEkNTYqhKUDWBdc9N88w8vfJ7axGIVW0aK1M7iJVRewuT58cerDytR62WT8NeJ4giKqK43ez2w4BT2myHzTCkLeR21r%2F0xpW%2FAQAA%2F%2F8BAAD%2F%2F%2Bp0O%2FeOBAAA IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ren.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9P7pnzCEY40rImg2Jop6kuqpmttzqrqaqa3p2TosByXHYi9feb3azmATRizeD9AY8BIQdT3tw%2FwQvQs4y4%2BLoO9R73%2FtewVffq2%2F23RlpwtHTax%2FrsVSKrnUafv3i50Fwub4hUzeqj7rhl2H7ct0M3%2BuFDf%2Bd%2BkeCbeu1ph%2F4fuAH9XVpRF%2BP1uYkZPaoFzR6fqPdbASdNkbm%2F9g6D5Z64MMz8jIkn6088S5Asgpp8sM1YbdznV36MHGK5tpgyI8%2BTbdTXaRIlmXfeOinR%2BfT0PZk%2FTF0eriQCz38dzCWM%2BL9%2BhhxenQuEvHwYKEzVhApYv4CimEFoSpIWoHpu5D8hACM4%2BYm0uT%2BTW0KuvMPS%2BfsjKw8%2BwuymJGVPy4gTb6%2FquSofkcrl0udWoz6JeSoghxUyNwx8nENsjgGy7%2BG5L%2BRtWcbSJODTas0JD99sydo1I3a%2FioLBF1t94L%2Batzt0dVOwMJ20O3QkImFQVJWkP0KSkxAbQ3OenDSg%2Bt7cJmHhJ%2FWWRAEkc8Z9bs9xlo8EnHI%2FYBG%2FYAGftiFY%2FM3TJBnEzA1ATO7yMwutuUExv0Cu1XCcg82JxjyEoUgKCxBQQkKSVDkBMWwPOTKNm15nyvr4uA8N89zq5zqfLBPD3U%2BECkBNRMYXu5nZ%2BSluYHexbcCbIvTuh%2B2Wp2wF3dEFEdM8G4Usb7f5O1WGLaioAkrS0hbA7UexnJG3n5tBZk8eSVFTI9h1TGY9EDd66BFCbpVYpw%2BpONMKGkbTCfgukSWryDf8fbVGXl1sb8b3z6AYE%2FJeYCZEpkp8ZV8QjBQ96a3dUEObuvCkh83s1wmckznu72T01w8%2F%2BCG2Cm04dev2cl377M5MS8ffSJsvkFTLtOBJQ%2BvSs6FWdeGCfLzdfuZiG85u3XVmdRlG7c%2BWL%2BeZEZYK3VagcqTL%2FbA5Iy8%2BNPG4tO%2BW%2F8T0lQwrkTilkqlrsCyXdhs2bOawKgljjMPhSunphkvm0oSKLHENC5h%2F4PjZT01dH6bynLf3sPA1EDzu0iTEkNTYqhKUDWBdc9N88w8vfJ7axGIVW0aK1M7iJVRewuT58cerDytR62WT8NeJ4giKqK43ez2w4BT2myHzTCkLeR21r%2F0xpW%2FAQAA%2F%2F8BAAD%2F%2F%2Bp0O%2FeOBAAA HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:35:59 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 9a4942aa8761a310b75f409b4bb2c51c
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.5.2 | 172.67.165.215 | 200 OK | 16 kB |
URL GET HTTP/2flowhot.cc/wp-includes/css/dist/block-library/style.min.css?ver=6.5.2 IP172.67.165.215:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeASCII text, with very long lines (59701) Hash51a8390b47aa0582cf2d9c96c5addee2 b16a640874025d085c38119a1a02a3460f83f2de 98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
GET /wp-includes/css/dist/block-library/style.min.css?ver=6.5.2 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: text/css
cache-control: public, max-age=31536000
expires: Fri, 10 May 2024 22:44:38 GMT
last-modified: Tue, 02 Apr 2024 23:54:40 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 1378279
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBrBwJ8miP2eotM0zgOuej0v5AHJARXW1VxqbPdhRHm7shkIb07EqXAsBAJNpbg0A8iB3GPIrsKcSwlgAyec5AhLbwvHCyN5B83z1y6JvaVM0PGOoA0hJ%2BePmHHB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a9b4a4f8c85693-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| flowhot.cc/wp-content/themes/flowhot/views.php?id=661212 | 172.67.165.215 | 200 OK | 7 B |
URL GET HTTP/3flowhot.cc/wp-content/themes/flowhot/views.php?id=661212 IP172.67.165.215:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeASCII text, with no line terminators Hash9872ed9fc22fc182d371c3e9ed316094 87d538ef1c1db71603e60f278446c86470162380 2811745d7b8d8874f6e653d176cefdd19e05e920ce389b9b7e83e5b2dfa546c7
GET /wp-content/themes/flowhot/views.php?id=661212 HTTP/1.1
Host: flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eYUSvNVbmJXBJroXfXvhyEQbWv0ov9uJoh5Z4rgprBm%2Bc55s3jxUtl%2FLn5rQk2mQYkrjjcViGD3UfORzaLPEsO0X6ASQL5C49sLrqqgIaS9FAkrR1MzSQavgZmDr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a9b4accc84b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| 661212.flowhot.cc/favicon.ico | 188.114.96.1 | 404 Not Found | 623 B |
URL GET HTTP/3661212.flowhot.cc/favicon.ico IP188.114.96.1:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeHTML document, ASCII text, with CRLF, LF line terminators Hashc21948269e1455539e719021b9e6118a 29bdc813691c0a2d3b46fbc44578e9fbf280fd04 14f5149d274240e23a9b5a18f809737c1ffd5349ef2b654e271044ebe17b2023
GET /favicon.ico HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1714167358.1.0.1714167358.0.0.0; _ga=GA1.1.1944747512.1714167359; dom3ic8zudi28v8lr6fgphwffqoz0j6c=9ea78740-c1ea-491f-b89a-51c64185a6ce%3A2%3A1; sb_main_0633569b5e7b7ced877cf02d43663712=1; sb_count_0633569b5e7b7ced877cf02d43663712=1; pbpr0tpuw4isk85t8yg3jb2lj5vqf=trebleuniversity.com; pp_main_b8d74904f6b94ccf8e1a8085aa5d1820=1; pp_idelay_b8d74904f6b94ccf8e1a8085aa5d1820=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wy%2BYSZTG15s%2Blo8S63mfWs9SfhxwWLW9jILocGYGQHMmsU4hVM%2FNRu2e%2F7QHWZHzR6cNbOPW7pGVnXOt2vNkHrixPVOyez2BGGD8hqRBIq6nAB7kkaoED5ZKuZmaAF6Uth1hlw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4b1b95856c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/img/1.jpg | 172.67.141.24 | 200 OK | 22 kB |
URL GET HTTP/2cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/img/1.jpg IP172.67.141.24:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 320x320, components 3 Hash7bcc800a4957dac955e91ce1ee3b73cd b1fae2cacecc790a22f91e2320077f89707473b1 760783cbcd04b3b7ef5f6b10a24878869d061709e4511ccada113b532833243d
GET //sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/img/1.jpg HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: image/jpeg
content-length: 21597
last-modified: Thu, 01 Feb 2024 14:55:47 GMT
etag: "65bbb0f3-545d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: HIT
age: 3185599
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gLZx78dYaKTd%2FhpmCp%2FKcXmdb1N48N6NieAM98Mr4KjxAoPp2TtTRusElQOeR1x1ATNOWs%2F7QFZeMutwxSQq4osZmoL3aRUbovxNBFy359j1hlNeN89w11pffNwS3oKRerr35MG7C6%2BF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4b429811c06-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/style.css | 172.67.141.24 | 200 OK | 1.0 kB |
URL GET HTTP/2cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/style.css IP172.67.141.24:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
Hash9b388680bb9d9cf0d8e7e4dad7b39ac5 393a2393f3b96b727a3114d249fffb35bf34d9f5 758934b1fbbad9e578664b4efbb5ee3303482d0d37ec7837b4bb2fa4915be70f
GET //sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/style.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: text/css
last-modified: Thu, 01 Feb 2024 14:55:46 GMT
etag: W/"65bbb0f2-e2e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FP3mdlh2TX%2BwGrek3q0qjUvvQ%2BD4vLlFIsSF8bB74PBz2Q1%2FtLk1fJYB4c3ow%2FfpVByvJfZW6E%2F%2F%2FYcx8d%2BFq8B9tb8pv12VS3sZz%2Bcmwe0%2F%2FT5h9bVLMF%2FDQnrSPwy%2BdNnBNgQ%2Bdgvx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4b349151c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fjs%2Fscript.js&l=386&fd=329 | 172.240.108.84 | 200 OK | 0 B |
URL GET HTTP/1.1trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fjs%2Fscript.js&l=386&fd=329 IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fjs%2Fscript.js&l=386&fd=329 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 IP216.58.207.227:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15744, version 1.0 Hash15d9f621c3bd1599f0169dcf0bd5e63e 7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52 f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 06:02:10 GMT
expires: Sat, 26 Apr 2025 06:02:10 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
age: 56031
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 | 216.58.207.227 | 200 OK | 16 kB |
URL GET HTTP/2fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 IP216.58.207.227:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33 ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 15860, version 1.0 Hashe9f5aaf547f165386cd313b995dddd8e acdef5603c2387b0e5bffd744b679a24a8bc1968 f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:55:49 GMT
expires: Sat, 26 Apr 2025 05:55:49 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
age: 56412
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| trebleuniversity.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9v3rGHIIxroSs2ZAo6knqV8%2BWW93VVHVPz85pMSA5Dnvx2vvNbhaTIHrxZpDegIeAsONpD%2B6f4EXIWWZcHH2Heu973yv46nv1zX5%2BRprI6em1j81YaU3XOg2%2FfvHzILhc31BJPqqPet0vu%2B3LdTt8r99t%2BO%2FUP5J826w1%2FcD3Az%2BorysrIzNam5NQ6aN%2B0Oj7jXazEXTaGNn%2FY5d7cNSDGJ6Rl6HEbOWJdwGKV0jiH65Jt52Z9NKHca5pZiyG4ujTZDsxRYJ4WUbWQ5QcnU%2FDuJP1xzDJ4UIuzPDfQaZmxPv1MVhydC4SbHiw0Mk0ZAImXkAxrCB1BUUrcHMXSpwQgAvc3EQS379pbEF3%2FmHpnJ2RlWd%2FQRUzsvLHBSTx91e1GtXvGJ1nyiQOo6iEGlVQgwppfoxsXIMqjsGzr6HEb2Tt2QaS%2BGDTaQMlTt%2FsSxr2wra%2FygNJV9v9IFplvT5d7QS82w56HdrlcmGQUhVUVEHLCairIXcecuUhjzzkqYdYnNZ5EAShLzj1e33OWyKUrCv8gIZRQAO%2F20PO52%2BYIEsn4HoCbneR2l1sqwls%2FgvcVgknPLiMYChKFJKgcAQFJSgUQZERFMPyUGjXdOV9oV3OgvPcPM%2BtcmqywT49NNlAJgTUTmBFuZ%2BekZfmBnoX3wqwLU%2FrfrfV6nT7rCNDFnIpemHII78p2q1utxUGTThVQrkaqPMwVjPy9msrSNXJKwkYPYbTx%2BDKA81fBy1K0K0S4%2BQhHadSK9fgJoYwJdJsBdmOt6%2FPyKuL%2Fd349gEkf0rOA9yWSG2Jr9QTgoG%2BN71tCnJw2xSO%2FLiZZipWYzrf7Z2MZvL5BzfkTmGsuH7NTb57n8%2BJefnoE%2BmyDZoIlQwceXhVCSHturFckp%2Bvu88ku5W7rau5TfJ049YH69fj1ErnlEkqUHXyxR64mpEXf9pYfNp3639C2Qo2LxHnS6XKVODpLly67DlDYPUSs9RDkZdT22TLplYEWi4xZSXcfzBb1lNL57epKvfdPQxsDTS7iyQuMbQlhroE1RO4%2FLlpltqnV35vLQJM16ZM29oB01bvLUyeH3tw6rTe8kXIZCRDJtuddiS5YJ0O83nEWUv0ehyZm0WX3rjyNwAAAP%2F%2FAQAA%2F%2F9qoO4fjgQAAA%3D%3D | 172.240.108.84 | 200 OK | 7 B |
URL GET HTTP/1.1trebleuniversity.com/impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9v3rGHIIxroSs2ZAo6knqV8%2BWW93VVHVPz85pMSA5Dnvx2vvNbhaTIHrxZpDegIeAsONpD%2B6f4EXIWWZcHH2Heu973yv46nv1zX5%2BRprI6em1j81YaU3XOg2%2FfvHzILhc31BJPqqPet0vu%2B3LdTt8r99t%2BO%2FUP5J826w1%2FcD3Az%2BorysrIzNam5NQ6aN%2B0Oj7jXazEXTaGNn%2FY5d7cNSDGJ6Rl6HEbOWJdwGKV0jiH65Jt52Z9NKHca5pZiyG4ujTZDsxRYJ4WUbWQ5QcnU%2FDuJP1xzDJ4UIuzPDfQaZmxPv1MVhydC4SbHiw0Mk0ZAImXkAxrCB1BUUrcHMXSpwQgAvc3EQS379pbEF3%2FmHpnJ2RlWd%2FQRUzsvLHBSTx91e1GtXvGJ1nyiQOo6iEGlVQgwppfoxsXIMqjsGzr6HEb2Tt2QaS%2BGDTaQMlTt%2FsSxr2wra%2FygNJV9v9IFplvT5d7QS82w56HdrlcmGQUhVUVEHLCairIXcecuUhjzzkqYdYnNZ5EAShLzj1e33OWyKUrCv8gIZRQAO%2F20PO52%2BYIEsn4HoCbneR2l1sqwls%2FgvcVgknPLiMYChKFJKgcAQFJSgUQZERFMPyUGjXdOV9oV3OgvPcPM%2BtcmqywT49NNlAJgTUTmBFuZ%2BekZfmBnoX3wqwLU%2FrfrfV6nT7rCNDFnIpemHII78p2q1utxUGTThVQrkaqPMwVjPy9msrSNXJKwkYPYbTx%2BDKA81fBy1K0K0S4%2BQhHadSK9fgJoYwJdJsBdmOt6%2FPyKuL%2Fd349gEkf0rOA9yWSG2Jr9QTgoG%2BN71tCnJw2xSO%2FLiZZipWYzrf7Z2MZvL5BzfkTmGsuH7NTb57n8%2BJefnoE%2BmyDZoIlQwceXhVCSHturFckp%2Bvu88ku5W7rau5TfJ049YH69fj1ErnlEkqUHXyxR64mpEXf9pYfNp3639C2Qo2LxHnS6XKVODpLly67DlDYPUSs9RDkZdT22TLplYEWi4xZSXcfzBb1lNL57epKvfdPQxsDTS7iyQuMbQlhroE1RO4%2FLlpltqnV35vLQJM16ZM29oB01bvLUyeH3tw6rTe8kXIZCRDJtuddiS5YJ0O83nEWUv0ehyZm0WX3rjyNwAAAP%2F%2FAQAA%2F%2F9qoO4fjgQAAA%3D%3D IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
File typeASCII text, with no line terminators Hash132d6af1b46048b45cf86cdee7991d31 eb7007d03d59b65bc6da7e098c4d38fc6dfb6285 ab852e838deccd742a03ca81d4a8d75cf1a00b327db3eaf46bd7da6b6db9384c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /impr.gif?sid=H4sIAAAAAAAC%2F1RSz4scRRSuHhcvgqDm5g%2FmoBglO9s9v3rGHIIxroSs2ZAo6knqV8%2BWW93VVHVPz85pMSA5Dnvx2vvNbhaTIHrxZpDegIeAsONpD%2B6f4EXIWWZcHH2Heu973yv46nv1zX5%2BRprI6em1j81YaU3XOg2%2FfvHzILhc31BJPqqPet0vu%2B3LdTt8r99t%2BO%2FUP5J826w1%2FcD3Az%2BorysrIzNam5NQ6aN%2B0Oj7jXazEXTaGNn%2FY5d7cNSDGJ6Rl6HEbOWJdwGKV0jiH65Jt52Z9NKHca5pZiyG4ujTZDsxRYJ4WUbWQ5QcnU%2FDuJP1xzDJ4UIuzPDfQaZmxPv1MVhydC4SbHiw0Mk0ZAImXkAxrCB1BUUrcHMXSpwQgAvc3EQS379pbEF3%2FmHpnJ2RlWd%2FQRUzsvLHBSTx91e1GtXvGJ1nyiQOo6iEGlVQgwppfoxsXIMqjsGzr6HEb2Tt2QaS%2BGDTaQMlTt%2FsSxr2wra%2FygNJV9v9IFplvT5d7QS82w56HdrlcmGQUhVUVEHLCairIXcecuUhjzzkqYdYnNZ5EAShLzj1e33OWyKUrCv8gIZRQAO%2F20PO52%2BYIEsn4HoCbneR2l1sqwls%2FgvcVgknPLiMYChKFJKgcAQFJSgUQZERFMPyUGjXdOV9oV3OgvPcPM%2BtcmqywT49NNlAJgTUTmBFuZ%2BekZfmBnoX3wqwLU%2FrfrfV6nT7rCNDFnIpemHII78p2q1utxUGTThVQrkaqPMwVjPy9msrSNXJKwkYPYbTx%2BDKA81fBy1K0K0S4%2BQhHadSK9fgJoYwJdJsBdmOt6%2FPyKuL%2Fd349gEkf0rOA9yWSG2Jr9QTgoG%2BN71tCnJw2xSO%2FLiZZipWYzrf7Z2MZvL5BzfkTmGsuH7NTb57n8%2BJefnoE%2BmyDZoIlQwceXhVCSHturFckp%2Bvu88ku5W7rau5TfJ049YH69fj1ErnlEkqUHXyxR64mpEXf9pYfNp3639C2Qo2LxHnS6XKVODpLly67DlDYPUSs9RDkZdT22TLplYEWi4xZSXcfzBb1lNL57epKvfdPQxsDTS7iyQuMbQlhroE1RO4%2FLlpltqnV35vLQJM16ZM29oB01bvLUyeH3tw6rTe8kXIZCRDJtuddiS5YJ0O83nEWUv0ehyZm0WX3rjyNwAAAP%2F%2FAQAA%2F%2F9qoO4fjgQAAA%3D%3D HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:01 GMT
Content-Type: image/gif
Content-Length: 7
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: e5f2887839a248d2bec19dec8316dc3a
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fanimate.css&l=79245&fd=331 | 172.240.108.68 | 200 OK | 0 B |
URL GET HTTP/1.1trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fanimate.css&l=79245&fd=331 IP172.240.108.68:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fanimate.css&l=79245&fd=331 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:01 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| unseenreport.com/pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 | 192.243.61.227 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=0633569b5e7b7ced877cf02d43663712&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:01 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f5be4f9e3fa5263d304cc70dc9447d0b
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| unseenreport.com/pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 | 192.243.61.227 | 200 OK | 1 B |
URL GET HTTP/1.1unseenreport.com/pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 IP192.243.61.227:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subject*.unseenreport.com Fingerprint71:46:15:FD:76:6A:F5:5B:51:06:CC:93:DD:D8:63:E3:8B:10:BF:13 ValidityFri, 22 Mar 2024 07:32:41 GMT - Thu, 20 Jun 2024 07:32:40 GMT
File typevery short file (no magic) Hash93b885adfe0da089cdf634904fd59f71 5ba93c9db0cff93f52b521d7420e43f6eda2784f 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pxf.gif?uuid=9ea78740-c1ea-491f-b89a-51c64185a6ce&eb=978028c5053b26833423c7a069ce3bd5&te=5db3a4e34790624df926db520a13f79f&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64%3B%20rv%3A96.0)%20Gecko%2F20100101%20Firefox%2F96.0&dev=e&res=14.2071&b_frame=0&pk=b8d74904f6b94ccf8e1a8085aa5d1820&bl=en-US&sr=1024x1280&sz=1024x1280&hjs=21 HTTP/1.1
Host: unseenreport.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:01 GMT
Content-Type: image/gif
Content-Length: 1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: f13707b8b4d8a97dc469f50e66d21396
Strict-Transport-Security: max-age=0; includeSubdomains
|
|
| trebleuniversity.com/pixel/sbs?c=1 | 172.240.108.68 | 200 OK | 0 B |
URL GET HTTP/1.1trebleuniversity.com/pixel/sbs?c=1 IP172.240.108.68:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbs?c=1 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:01 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| 661212.flowhot.cc/dectector.js | 188.114.96.1 | 404 Not Found | 1.2 kB |
URL GET HTTP/3661212.flowhot.cc/dectector.js IP188.114.96.1:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeHTML document, ASCII text, with very long lines (1258), with no line terminators Hashe7d535c84c0e6c93bef13bb985436563 d6942a9b4ca1610734b194034b06e7b37fbca8e0 58352a045b089e101dce2cf9f2bb6fb64e88903f0d694996ebcad4d408224088
GET /dectector.js HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: _ga_Z7TJ1ZBHKC=GS1.1.1714167358.1.0.1714167358.0.0.0; _ga=GA1.1.1944747512.1714167359
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ye%2FOPUYq4OidVYz7W%2BBvPZKwSEXJzkmsagwv7yvnj0f4jwC617DuK%2Bo5wvLr9ERqalXCUsE2LyEDzQuOeuwHkYIEC5L33wMiIkWdB0arCHTpQ124zQBVvn8ILeMjxTBjEF0niQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4ab8ba256c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| downstairsnegotiatebarren.com/sfp.js | 104.21.35.227 | 200 OK | 86 kB |
URL GET HTTP/2downstairsnegotiatebarren.com/sfp.js IP104.21.35.227:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectdownstairsnegotiatebarren.com Fingerprint2C:6A:E1:8E:26:5B:1D:8B:86:CB:C1:72:4E:52:4B:8B:67:3A:D2:44 ValidityMon, 04 Mar 2024 21:53:07 GMT - Sun, 02 Jun 2024 21:53:06 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: downstairsnegotiatebarren.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 72f9cc152d63c4f078ca42091c04f7f8
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 26 Apr 2024 21:35:59 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMe4cnv8GijFpFtrpztYEj9lAP6XiqbUmRb116a0pKT5c6Kf0fHjDVKVIZMSwsP7VwzjJIlri3NA7fWbgblOZj%2FkwgwV2BE%2BGZBnOWH%2BRWMOTlIpm%2BhwoHg28hzRU3ge4fPbfFUr0QlgndGp7fOx9A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4ab385ab4ee-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.yourwebbars.com/sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/index.html | 172.67.74.218 | 200 OK | 1.6 kB |
URL GET HTTP/2cdn.yourwebbars.com/sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/index.html IP172.67.74.218:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerCloudflare, Inc. Subjectsni.cloudflaressl.com Fingerprint84:82:6E:35:03:D4:C4:FC:BA:08:CD:C8:E6:A3:97:A9:20:2F:F5:49 ValiditySun, 23 Jul 2023 00:00:00 GMT - Mon, 22 Jul 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (1660), with no line terminators Hash0029b7cb4d5550c5233f931c816165ea 31298b092158bb9ce60a8e9bf497c5bd1f562a11 26ba2ea9cf182d890d03039af9052b75e71a92a6f3a9a386e955428677907062
GET /sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/index.html HTTP/1.1
Host: cdn.yourwebbars.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: text/html
last-modified: Thu, 01 Feb 2024 14:55:44 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QRqE1HBj9gV9wnSLyKTU38jtK7P04qRHIQ3u7Zc1HjtoCaWaw2kV%2B9quiAn8dI8EpTmUWWqub31lMqNce0G4ldWDBUEk2xcmKTHJ9%2Bi2t697MQbtdwpJYX2wvrPiyeleutyR8zw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4af5e06b51b-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/js/script.js | 172.67.141.24 | 200 OK | 386 B |
URL GET HTTP/2cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/js/script.js IP172.67.141.24:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
File typeASCII text, with very long lines (399), with no line terminators Hash022602a468da44628060800173771da2 9be813fbfebbcb2aa46d8c6b8abec68b3d16c89c 6742c376e658c34d09b2dc5772bd798e3cd52bb265758bac5bce184f8ee7b5cc
GET //sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/js/script.js HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: application/javascript
last-modified: Thu, 01 Feb 2024 14:55:49 GMT
etag: W/"65bbb0f5-182"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ETAmL2jj%2B%2B0VF78yiwt7RG6V9hURhHKXfAmkIablcIJzJe6w4tYykz6Gz6O2P8rQQTILkBHuhK1nx4TaOXdVIeR1YQRxF0yfJFsRR3sMXJHol6s7C6qRwy6hPQufWbWvskWe95hdKLDp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4b359181c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/animate.css | 172.67.141.24 | 200 OK | 79 kB |
URL GET HTTP/2cdn.creative-bars1.com//sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/animate.css IP172.67.141.24:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectcreative-bars1.com Fingerprint3D:29:39:2C:F1:E5:C6:EF:54:F5:70:B5:CF:A8:C2:75:4D:89:72:13 ValidityMon, 15 Apr 2024 15:02:18 GMT - Sun, 14 Jul 2024 15:02:17 GMT
Hash80047eaa13ebd50c50e8a9753621e430 9c503e07d130572a0eaf51f7c02cbd4cf6213fe3 3f831a59615f8d5d40b4340b2836f91438c876f8dbce75f78e38360d6fe0f429
GET //sb/notifications/utility/default/us/blog/ecorious/message_redcircle2/jan24/4/css/animate.css HTTP/1.1
Host: cdn.creative-bars1.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://661212.flowhot.cc
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: text/css
last-modified: Thu, 01 Feb 2024 14:55:44 GMT
etag: W/"65bbb0f0-1358d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: public, max-age=315360000
access-control-allow-origin: *
access-control-expose-headers: Date
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FAHec%2FwHpC3cZ6bm9t4fNJ8R9W5NKIVXSc0Vsg4HjgpVRLtDNEvvAr0SlRPv6gfY54juhBdMTszfy5IyjOLUzN8TcmviP4RXyzu%2FHXcZmiCdeX6johwdbpC3qKa0NVPe1gZHmw6099nq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4b349111c06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css | 104.18.10.207 | 200 OK | 31 kB |
URL GET HTTP/2maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css IP104.18.10.207:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectbootstrapcdn.com Fingerprint57:B4:25:B9:9C:88:A1:A3:3D:F7:31:74:02:E4:D1:E0:0A:F5:11:63 ValidityWed, 27 Mar 2024 00:22:09 GMT - Tue, 25 Jun 2024 00:22:08 GMT
File typeASCII text, with very long lines (30837) Hash269550530cc127b6aa5a35925a7de6ce 512c7d79033e3028a9be61b540cf1a6870c896f8 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: maxcdn.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"269550530cc127b6aa5a35925a7de6ce"
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 10/31/2023 18:48:06
cdn-proxyver: 1.04
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 722
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: 9e61a4e37a75208649ae6b63a0cb4f72
cdn-cache: HIT
cf-cache-status: HIT
age: 13107628
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 87a9b4a50f6f0b65-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fstyle.css&l=3630&fd=317 | 172.240.108.84 | 200 OK | 0 B |
URL GET HTTP/1.1trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fstyle.css&l=3630&fd=317 IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.creative-bars1.com%2F%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Fcss%2Fstyle.css&l=3630&fd=317 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| 661212.flowhot.cc/dectector.js | 188.114.96.1 | 404 Not Found | 1.2 kB |
URL GET HTTP/3661212.flowhot.cc/dectector.js IP188.114.96.1:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
File typeHTML document, ASCII text, with very long lines (1258), with no line terminators Hashe7d535c84c0e6c93bef13bb985436563 d6942a9b4ca1610734b194034b06e7b37fbca8e0 58352a045b089e101dce2cf9f2bb6fb64e88903f0d694996ebcad4d408224088
GET /dectector.js HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 21:35:58 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lvxbD5eilWhXNGmp7CfwmIxrxGvoH1ijW05gypRE4ftV%2FTht%2B3PL9tWkb0DP%2BXyx1tLMaDzwBzSJpTU68AXsofCNDppaeebSW0%2Bvi7HlVTiuTLHXXUE9xYYKTKV0iejG14m0hw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4a4dd9356c6-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| supervisebradleyrapidly.com/pixel/purst?dl=0&th=0&sc=0&rs=1913&rd=1913&fd=513&bv=24.4.7838&tmpl=136 | 192.243.59.12 | 200 OK | 0 B |
URL GET HTTP/1.1supervisebradleyrapidly.com/pixel/purst?dl=0&th=0&sc=0&rs=1913&rd=1913&fd=513&bv=24.4.7838&tmpl=136 IP192.243.59.12:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectsupervisebradleyrapidly.com FingerprintB9:18:E3:8A:C9:DC:5E:0A:A3:8F:1C:44:1F:63:28:86:43:4F:A2:E2 ValidityWed, 24 Apr 2024 15:15:52 GMT - Tue, 23 Jul 2024 15:15:51 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/purst?dl=0&th=0&sc=0&rs=1913&rd=1913&fd=513&bv=24.4.7838&tmpl=136 HTTP/1.1
Host: supervisebradleyrapidly.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Fri, 26 Apr 2024 21:36:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| downstairsnegotiatebarren.com/sfp.js | 104.21.35.227 | 200 OK | 86 kB |
URL GET HTTP/3downstairsnegotiatebarren.com/sfp.js IP104.21.35.227:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectdownstairsnegotiatebarren.com Fingerprint2C:6A:E1:8E:26:5B:1D:8B:86:CB:C1:72:4E:52:4B:8B:67:3A:D2:44 ValidityMon, 04 Mar 2024 21:53:07 GMT - Sun, 02 Jun 2024 21:53:06 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /sfp.js HTTP/1.1
Host: downstairsnegotiatebarren.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 26 Apr 2024 21:36:00 GMT
content-type: application/javascript; charset=utf-8
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
expires: Thu, 01 Jan 1970 00:00:01 GMT
cache-control: max-age=14400
x-request-id: 0b1ff8beea36fbf5ee4030fb89500643
strict-transport-security: max-age=0; includeSubdomains
cf-cache-status: EXPIRED
last-modified: Fri, 26 Apr 2024 21:35:59 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ueom2frJ55aFtqmleVPF%2FM1Fm1gvbgh93C%2FifN5MU85tbYiF%2FWHpqcPQmiHN0EB55kua8X0BwIWTLsgaXceCs3fOUJeHUwH%2Ft9t%2Fm2dpd67cBO6PVgdPgRX4oWHYRfJeDR6WooMm4ddDMfLqLsLqyg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a9b4ae59415699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.yourwebbars.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Findex.html&l=1571&fd=593 | 172.240.108.84 | 200 OK | 0 B |
URL GET HTTP/1.1trebleuniversity.com/pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.yourwebbars.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Findex.html&l=1571&fd=593 IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /pixel/sbls?bv=24.6.6370&tmpl=482&u=https%3A%2F%2Fcdn.yourwebbars.com%2Fsb%2Fnotifications%2Futility%2Fdefault%2Fus%2Fblog%2Fecorious%2Fmessage_redcircle2%2Fjan24%2F4%2Findex.html&l=1571&fd=593 HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Cookie: u_pl=19408177; uid_id2=9ea78740-c1ea-491f-b89a-51c64185a6ce:2:1; pdhtkv=true; uncs=1; pdhtkv29=true; uncs29=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:36:00 GMT
Content-Length: 0
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Upgrade-Insecure-Requests
Access-Control-Expose-Headers: Content-Length,Content-Range
|
|
| | 188.114.96.1 | 200 OK | 532 kB |
URL User Request GET HTTP/2IP188.114.96.1:443
CertificateIssuerGoogle Trust Services LLC Subjectflowhot.cc FingerprintE0:1A:48:2F:23:6B:FB:6D:2F:7B:45:13:3F:15:AD:CC:A7:FF:47:64 ValiditySun, 14 Apr 2024 17:27:24 GMT - Sat, 13 Jul 2024 17:27:23 GMT
Size532 kB (532494 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: 661212.flowhot.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 26 Apr 2024 21:35:57 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-litespeed-cache: hit
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hjUWWaK2QzpvdUFB8lykXjehhhJFWICN2AZJyY0TXQZOYYLgfmXSdvT6GfuPbLTEqJUkG2Swex5gA1AQIuKpRIWC3t%2FuvXoqZ%2BMpxFF%2F0jSNF2h285nJu5RQfoTtzg8Cg5HGvg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a9b4a27eb356a9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| trebleuniversity.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js | 172.240.108.84 | 200 OK | 82 kB |
URL GET HTTP/1.1trebleuniversity.com/b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js IP172.240.108.84:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjecttrebleuniversity.com FingerprintBB:85:33:0C:29:8B:B9:F9:12:37:D8:BE:36:46:F1:D3:EC:A5:DB:42 ValidityTue, 23 Apr 2024 10:53:58 GMT - Mon, 22 Jul 2024 10:53:57 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash3f4ca193977d72bf41dc59792bb264a4 58d29a14da759fe2012ce174e3211a7edc4031ac ea43cfad583652005c72894b78395ec1460369d4cebea7fb48c25e4b13158bc8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /b8/d7/49/b8d74904f6b94ccf8e1a8085aa5d1820.js HTTP/1.1
Host: trebleuniversity.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Fri, 26 Apr 2024 21:35:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Set-Cookie: 4b4e7ab587d59b22ad7bcd2439afc363_CF-2931_new=0; expires=Sun, 28 Apr 2024 21:35:59 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 28829124e9ac655d836109902b6b8c4b
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip
|
|
| notix.io/ent/current/enot.min.js | 139.45.197.253 | 200 OK | 145 kB |
URL GET HTTP/2notix.io/ent/current/enot.min.js IP139.45.197.253:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerLet's Encrypt Subjectnotix.io Fingerprint3C:56:70:26:73:9D:43:E7:28:EF:40:FE:65:98:CD:7B:0A:56:D9:1B ValiditySat, 17 Feb 2024 20:57:19 GMT - Fri, 17 May 2024 20:57:18 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size145 kB (145421 bytes) Hash9a3ae56c31a58c28e606e1e069a21059 ea3cdfcda002044373d2090e1745f83a15b82d17 6ccf4be26c7c79133eaf94c9c64a2ace27574e72d4c40c3c2011479cadca1f55
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Unique code from Jetriz, Swid & Jeniva of the Tetris framework |
GET /ent/current/enot.min.js HTTP/1.1
Host: notix.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://661212.flowhot.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 26 Apr 2024 21:35:59 GMT
content-type: application/javascript
last-modified: Wed, 13 Mar 2024 11:17:38 GMT
etag: W/"65f18b52-2380d"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap | 142.250.74.106 | 200 OK | 7.0 kB |
URL GET HTTP/2fonts.googleapis.com/css?family=Roboto:300,400,700&display=swap IP142.250.74.106:443
Requested byhttps://661212.flowhot.cc/ CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50 ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT
File typeASCII text, with very long lines (7193), with no line terminators Hash16b49a99486594c0b42d9bd7821deb2c 2fb46e5e86d6b37d4497cc04bfd89b3cb33a276a 3f3540952441e06ef81189cf63d46bac242804e386779dbb0cdd78ed10025c21
GET /css?family=Roboto:300,400,700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 21:36:00 GMT
date: Fri, 26 Apr 2024 21:36:00 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
0.0.0.0