Report - stownrusis.com/s?bvcR

Report Overview

Submitted URL
stownrusis.com/s?bvcR
IP
172.67.174.33
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 17:20:33
Access
public
Website Title
JADA STEVENS
Final URL
stownrusis.com/s?bvcR
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
pogothere.xyz	unknown	2022-08-22	2022-09-04	2024-04-25	842 B	112 kB	104.21.24.208
stownrusis.com	unknown	2023-12-31	2024-02-01	2024-03-04	477 B	96 kB	104.21.72.26
undefined	142677	unknown	2020-01-28	2023-07-23	962 B	0 B	0.0.0.0
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	934 B	3.0 MB	142.250.74.106
dfdgfruitie.xyz	unknown	2022-08-22	2022-12-12	2024-04-18	409 B	713 B	172.67.132.206
gforanopportu.info	unknown	2023-11-07	2023-11-27	2024-04-18	509 B	913 B	104.21.25.241
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-26	520 B	8.7 kB	216.58.207.227
d1wzdj81h1hubn.cloudfront.net	unknown	2008-04-25	2023-01-18	2024-04-18	435 B	3.0 MB	54.230.241.226
d16sobzswqonxq.cloudfront.net	unknown	2008-04-25	2024-04-25	2024-04-25	414 B	91 kB	3.164.247.110
quitesousefulhe.info	unknown	2024-03-31	2024-03-31	2024-04-25	991 B	1.3 kB	104.21.13.159

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	undefined	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	stownrusis.com/s?bvcR	92 kB	2024-04-26	2024-04-26
Pretty URL stownrusis.com/s?bvcR IP 104.21.72.26 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-26 19:20:34 Last Seen2024-04-26 19:20:34 Times Seen1 Hash 5f59dfc52626cccfe119abf66d29e34d 4cf6365d445c54e2e25b1987ff97b07806712c3c a61197c79ca6ce0c33465b3208095127bca4cbc01dfa0a22db2fdf5108362573 Loading...

	dfdgfruitie.xyz/adserver/yzfdmoan.js	0 B	2023-03-07	2024-05-07
Pretty URL dfdgfruitie.xyz/adserver/yzfdmoan.js IP 172.67.132.206 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-07 11:18:44 Times Seen37400483 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	d16sobzswqonxq.cloudfront.net/?tid=987092	230 kB	2024-04-26	2024-04-26
Pretty URL d16sobzswqonxq.cloudfront.net/?tid=987092 IP 3.164.247.110 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 19:20:34 Last Seen2024-04-26 19:20:35 Times Seen2 Hash efb9055966c4a89b63b7830fc9a9ec27 d4e487378940477bd62e37c0570815b5a069d9e6 9c0af0a1c58d139289cbd4d5b007be192903e3cc358e2909bf7cf71ca731bde5 Loading...

HTTP Transactions (13)

URL IP Response Size

d1wzdj81h1hubn.cloudfront.net/fukgehe.gif

54.230.241.226

200 OK

3.0 MB

URL GET HTTP/2
d1wzdj81h1hubn.cloudfront.net/fukgehe.gif
IP
54.230.241.226:443
ASN
#16509 AMAZON-02

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
GIF image data, version 89a, 256 x 256
Size
3.0 MB (2960491 bytes)
Hash
0663e2c4cc9ea33d9671973688259016
4d1f077219ae5a7463666c1fb9a3cee0234ffbfa
5b754907d8b995ea07310489f663f194dabe169c96b918d06f8323b0c928664f

HTTP Headers

GET /fukgehe.gif HTTP/1.1
Host: d1wzdj81h1hubn.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/gif
content-length: 2960491
date: Fri, 26 Apr 2024 17:15:27 GMT
last-modified: Mon, 22 May 2023 14:11:49 GMT
etag: "0663e2c4cc9ea33d9671973688259016"
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 5bcfe2deda0bdbc6bade0af9b61602ca.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: dZmqrttZ8mjLup-L56HvTOMQ6hSy3teMLbsS-EtDcxs_CAGtbrPBfA==
age: 281
X-Firefox-Spdy: h2

fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap

142.250.74.106

200 OK

3.0 MB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
gzip compressed data, max compression
Size
3.0 MB (2961371 bytes)
Hash
02ca9c4902f34f434552a3e6518f755c
1e1544820b18938a49fec6ec0700d680c887dc87
7123a77643dfff9aa528750f7be9fd20ef4735924014fa4519a3ba2e853d6017

HTTP Headers

GET /css2?family=Roboto:wght@100;300;400;500;700;900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:20:07 GMT
date: Fri, 26 Apr 2024 17:20:07 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

dfdgfruitie.xyz/adserver/yzfdmoan.js

172.67.132.206

200 OK

0 B

URL GET HTTP/2
dfdgfruitie.xyz/adserver/yzfdmoan.js
IP
172.67.132.206:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectdfdgfruitie.xyz
Fingerprint9B:73:95:36:E6:2A:E8:AE:DA:A0:BE:44:07:A2:37:71:C9:26:70:46
ValidityFri, 29 Mar 2024 21:30:02 GMT - Thu, 27 Jun 2024 21:30:01 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /adserver/yzfdmoan.js HTTP/1.1
Host: dfdgfruitie.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:20:08 GMT
content-type: application/x-javascript
content-length: 0
last-modified: Fri, 03 Feb 2023 19:26:28 GMT
etag: "63dd5fe4-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 352
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wosBxOyeqsXvdf9GwzW6HsSt7q%2BTltQNqpbO30cyl7SP66uzhAV8mkZeHH%2BQleCfAuCFmssx1ac4XN4qtkiyIjDRXBMaFRyzSUaQyVB%2BPGzdOWP97QRbHU4jSn28Z%2B%2FaSDc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a83de3fc8e56c1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

d16sobzswqonxq.cloudfront.net/?tid=987092

3.164.247.110

200 OK

90 kB

URL GET HTTP/2
d16sobzswqonxq.cloudfront.net/?tid=987092
IP
3.164.247.110:443
ASN
#0

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerAmazon
Subject*.cloudfront.net
FingerprintFA:21:45:DC:4D:94:03:A3:09:77:51:78:4A:21:F2:C5:6D:94:BE:52
ValidityTue, 10 Oct 2023 00:00:00 GMT - Thu, 19 Sep 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (891)
Size
90 kB (90173 bytes)
Hash
efb9055966c4a89b63b7830fc9a9ec27
d4e487378940477bd62e37c0570815b5a069d9e6
9c0af0a1c58d139289cbd4d5b007be192903e3cc358e2909bf7cf71ca731bde5

HTTP Headers

GET /?tid=987092 HTTP/1.1
Host: d16sobzswqonxq.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-length: 90173
date: Fri, 26 Apr 2024 17:20:08 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 2d4ccfc38ee1229022124d55e34be376.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: 4TBJ9jL5k5yNoy3sDaoAoQWhClnglTOuviMFIeiZ6drRvf1QfG_YEQ==
X-Firefox-Spdy: h2

quitesousefulhe.info/UlprWXh9ZQgqRTANImshBgAyDB8YCS81QTMeWjI9CgwmGC01bk0tETZnUmFPYmNZfwg7PlZqTXQpHzgMJylWaF47NA02RXQsVmlWZ3Rdd0p0L1ZoXiYqCj5FY3wbLQw+Z1puSWZrXmtIYmNZYE4

104.21.13.159

204 No Content

0 B

URL GET HTTP/2
quitesousefulhe.info/UlprWXh9ZQgqRTANImshBgAyDB8YCS81QTMeWjI9CgwmGC01bk0tETZnUmFPYmNZfwg7PlZqTXQpHzgMJylWaF47NA02RXQsVmlWZ3Rdd0p0L1ZoXiYqCj5FY3wbLQw+Z1puSWZrXmtIYmNZYE4
IP
104.21.13.159:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectquitesousefulhe.info
Fingerprint1E:2F:3F:D7:F4:CF:87:22:89:01:91:57:22:5C:03:AF:53:C8:1D:D7
ValiditySun, 31 Mar 2024 11:30:08 GMT - Sat, 29 Jun 2024 11:30:07 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /UlprWXh9ZQgqRTANImshBgAyDB8YCS81QTMeWjI9CgwmGC01bk0tETZnUmFPYmNZfwg7PlZqTXQpHzgMJylWaF47NA02RXQsVmlWZ3Rdd0p0L1ZoXiYqCj5FY3wbLQw+Z1puSWZrXmtIYmNZYE4 HTTP/1.1
Host: quitesousefulhe.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Fri, 26 Apr 2024 17:20:09 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dRkvThiOKvrzszEf2nS6%2BXx6fFDwtmoorxVBr8eaN8HuhTbbOFa0cqBytLgBPgRql4HUlz9Y1gKw41GX1kLRylYqpVNrnHeGNw%2FDzNgiBSOgnnFTqcltMZtJiq7pz1GPnlXEyxUdjw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a83deaabf75685-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

gforanopportu.info/tc

104.21.25.241

200 OK

0 B

URL POST HTTP/2
gforanopportu.info/tc
IP
104.21.25.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectgforanopportu.info
Fingerprint88:EF:8F:A6:1A:10:6F:B7:78:8F:B9:49:D0:08:96:29:77:D2:8D:F5
ValidityWed, 28 Feb 2024 10:32:46 GMT - Tue, 28 May 2024 10:32:45 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

OPTIONS /tc HTTP/1.1
Host: gforanopportu.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Fri, 26 Apr 2024 17:20:10 GMT
set-cookie: ci=1692684571808980; Max-Age=86400; Secure; SameSite=None
access-control-allow-origin: https://stownrusis.com
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GYt5QskHe7e7Tf2lQ8dzA%2Bu2vZiFUjHCRFQG4p0pbrcJkC8MwP5pgpu9jyr%2Fm4YqhgzTNFDN7%2FNjD%2FoJd1C%2FxoT8%2BpejxAiI2FSCTmAh8B%2BxTBngSnrmShlzJdc3vIeDAhE0hHY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a83ded9e555693-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2

216.58.207.227

200 OK

7.9 kB

URL GET HTTP/2
fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint93:EC:35:60:8A:5B:23:EA:C0:36:D7:AE:03:0C:C3:77:17:5A:20:33
ValidityMon, 08 Apr 2024 07:31:57 GMT - Mon, 01 Jul 2024 07:31:56 GMT

File type
Web Open Font Format (Version 2), TrueType, length 7884, version 1.0
Size
7.9 kB (7884 bytes)
Hash
9212f6f9860f9fc6c69b02fedf6db8c3
ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

HTTP Headers

GET /s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 26 Apr 2024 05:53:15 GMT
expires: Sat, 26 Apr 2025 05:53:15 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 22 Mar 2024 00:00:38 GMT
content-type: font/woff2
age: 41216
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

pogothere.xyz/asd100.bin

104.21.24.208

200 OK

110 kB

URL GET HTTP/2
pogothere.xyz/asd100.bin
IP
104.21.24.208:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectpogothere.xyz
Fingerprint34:D3:33:F8:49:E2:1E:3E:44:A8:5D:74:68:9C:B8:A0:D5:F8:DD:0B
ValidityWed, 27 Mar 2024 02:15:30 GMT - Tue, 25 Jun 2024 02:15:29 GMT

File type
data
Size
110 kB (110052 bytes)
Hash
d51a0a05c1ff539a45e39452f29a0eb2
be1254a049b97ddf3f52e04f5917c40467aff497
48bacf3663a8e677a694fbd8ef1e9b90892471f5a5bc6b6a68fee013bf74faaa

HTTP Headers

GET /asd100.bin HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:20:09 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://stownrusis.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 4049
last-modified: Fri, 26 Apr 2024 16:12:40 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OoThaetXSr94n0g7Z4t%2BHP7p9cOxiKYNZpLYxVjXadEpGKMiDrIffQEyXHIbzFhOHWjRntOxstdmeUQUYdf%2BunWAqqXaOjsMx4PQ0%2FvE8HeGn85Wlzf8i5xWkaicR06%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a83deaadf156cb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

quitesousefulhe.info/popunder.gif

104.21.13.159

200 OK

35 B

URL GET HTTP/3
quitesousefulhe.info/popunder.gif
IP
104.21.13.159:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectquitesousefulhe.info
Fingerprint1E:2F:3F:D7:F4:CF:87:22:89:01:91:57:22:5C:03:AF:53:C8:1D:D7
ValiditySun, 31 Mar 2024 11:30:08 GMT - Sat, 29 Jun 2024 11:30:07 GMT

File type
GIF image data, version 89a, 1 x 1
Size
35 B (35 bytes)
Hash
28d6814f309ea289f847c69cf91194c6
0f4e929dd5bb2564f7ab9c76338e04e292a42ace
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

HTTP Headers

GET /popunder.gif HTTP/1.1
Host: quitesousefulhe.info
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 17:20:09 GMT
content-type: image/gif
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
cf-cache-status: HIT
age: 143540
last-modified: Thu, 25 Apr 2024 01:27:49 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SLxOQ%2BlhVJk8GtKhB8%2Fkeg3XBHWOdbjbfY72kbVIt9Qb7TMmewDICvZN1If%2FYDRokCzS1eRRFAKdIGonRfgj87vywBH5k%2BTc6%2FxRirKsZAZKeIKElkE7SlvUsvn3ShZTArgcV8kWyw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a83decaabe5690-OSL
alt-svc: h3=":443"; ma=86400

fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap

142.250.74.106

200 OK

781 B

URL GET HTTP/3
fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint5F:6D:48:87:16:89:1E:A5:57:29:92:8B:34:BD:F2:92:0C:7F:F2:50
ValidityMon, 08 Apr 2024 07:32:03 GMT - Mon, 01 Jul 2024 07:32:02 GMT

File type
ASCII text, with very long lines (799), with no line terminators
Size
781 B (781 bytes)
Hash
f2734c367eb54d2729867445e0ea79a8
18f8b32901dae48bedc55cc12baca116e56e6bb7
d5f6fe55368116052648d76167ba4c103db2e0e52680340cd0cb014d3f6cf1d4

HTTP Headers

GET /css?family=Poppins:wght@300;400;500;600;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 17:20:09 GMT
date: Fri, 26 Apr 2024 17:20:09 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

stownrusis.com/s?bvcR

104.21.72.26

200 OK

96 kB

URL User Request GET HTTP/2
stownrusis.com/s?bvcR
IP
104.21.72.26:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectstownrusis.com
Fingerprint30:C8:89:AC:75:9B:91:EB:F9:13:4C:D7:D0:72:E4:2F:8B:B7:87:39
ValiditySun, 31 Mar 2024 11:48:50 GMT - Sat, 29 Jun 2024 11:48:49 GMT

File type
HTML document, ASCII text, with very long lines (61155)
Size
96 kB (95519 bytes)
Hash
790b04b7b61ce7124eef2d762684f256
33d71cec0604e8204334a41b29c4ebffa7368f7e
3ce0739954757d790d43018fb9169c065eb165f98c65ec770d7634b6be624253

HTTP Headers

GET /s?bvcR HTTP/1.1
Host: stownrusis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:20:06 GMT
content-type: text/html
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nUTzmOVgzQoR5PYYZAOXMdGEBJJMFmPa2vvihaJtZYyB4PvPtHBt4SqcxD3GFzI2b%2BdBA9tZNeLlikUrpBDM43T2Ulf3c77M6tWn0kDEii7afAHOSyISO0lrJD7Ob5z0ZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a83dd9dc2d56ca-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

pogothere.xyz/

104.21.24.208

200 OK

27 B

URL GET HTTP/2
pogothere.xyz/
IP
104.21.24.208:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stownrusis.com/s?bvcR
Certificate
IssuerGoogle Trust Services LLC
Subjectpogothere.xyz
Fingerprint34:D3:33:F8:49:E2:1E:3E:44:A8:5D:74:68:9C:B8:A0:D5:F8:DD:0B
ValidityWed, 27 Mar 2024 02:15:30 GMT - Tue, 25 Jun 2024 02:15:29 GMT

File type
ASCII text, with no line terminators
Size
27 B (27 bytes)
Hash
5de238fd28584af3658704ebc79cabcf
01f12237d7fd1071594f3a8f17a7b6f18f914926
ea1920ee796d0d44d955c8b1d388a25b871afdbcb40cda478c2658ce1b7165b7

HTTP Headers

GET / HTTP/1.1
Host: pogothere.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://stownrusis.com/
Origin: https://stownrusis.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 17:20:09 GMT
content-type: text/plain
set-cookie: csu=1101402946564823@1@1714152009; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://stownrusis.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NXtURjjYBAU%2F9CyjzQOABzcHB9HFy6uz0zPrkzvJo4DOqRd9GMzHhiejwFU9PyhQFr8P7RXz1IS1V%2FbSitbXGOBKIHtehWL2X868axjFrCr%2Bt2VmuTuPAz6uUZ1s4TWU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a83deaadea56cb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

undefined/cUtyNWYQKRFYWRB2EBMTAydPEFQ3bkBzAkB9AVoECzgFRAkfMwMbBR0kB1EAAyQcQUgfLgYQVDcyF14KHygmYDw7LBltJRZ/FXRWBgYjW1MpGDNRBT4ZJ2AzQShEcB5ECDRxFSIKHkIsKzwjUDE3PBhzJEQpMVs3PQUlbFQ2PEoNPCMKB3kzJxo7QlMzCScNAxUNFm0xIzgcdCMGHzpMBTQfM2cFOgo/YSU0fgRwETcqN203IgNDcAA9PEZTMzN+BHAOMAI0TD8VDDReMToOOHEFQXIcY1cgAyFYIxcaM2cAFCIkYCRBJB5xDkgKM1geJxonBCUXMV9dLjAdSwMsJxo6ZgwCGSR0P0YoNHMAMx08RjAkDSF9Hx4GOl0kOA9DYyQzDgIAMBoON21VBRM0BBE4BzNwAyUdSwIvJCw2Yy4dCTB0Dj1tGEYJHztPWSIiByBdKyEhFX9SFBI1

0.0.0.0

0 B

URL GET
undefined/cUtyNWYQKRFYWRB2EBMTAydPEFQ3bkBzAkB9AVoECzgFRAkfMwMbBR0kB1EAAyQcQUgfLgYQVDcyF14KHygmYDw7LBltJRZ/FXRWBgYjW1MpGDNRBT4ZJ2AzQShEcB5ECDRxFSIKHkIsKzwjUDE3PBhzJEQpMVs3PQUlbFQ2PEoNPCMKB3kzJxo7QlMzCScNAxUNFm0xIzgcdCMGHzpMBTQfM2cFOgo/YSU0fgRwETcqN203IgNDcAA9PEZTMzN+BHAOMAI0TD8VDDReMToOOHEFQXIcY1cgAyFYIxcaM2cAFCIkYCRBJB5xDkgKM1geJxonBCUXMV9dLjAdSwMsJxo6ZgwCGSR0P0YoNHMAMx08RjAkDSF9Hx4GOl0kOA9DYyQzDgIAMBoON21VBRM0BBE4BzNwAyUdSwIvJCw2Yy4dCTB0Dj1tGEYJHztPWSIiByBdKyEhFX9SFBI1
IP
0.0.0.0:0
ASN
#0

Requested by
https://stownrusis.com/s?bvcR

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /cUtyNWYQKRFYWRB2EBMTAydPEFQ3bkBzAkB9AVoECzgFRAkfMwMbBR0kB1EAAyQcQUgfLgYQVDcyF14KHygmYDw7LBltJRZ/FXRWBgYjW1MpGDNRBT4ZJ2AzQShEcB5ECDRxFSIKHkIsKzwjUDE3PBhzJEQpMVs3PQUlbFQ2PEoNPCMKB3kzJxo7QlMzCScNAxUNFm0xIzgcdCMGHzpMBTQfM2cFOgo/YSU0fgRwETcqN203IgNDcAA9PEZTMzN+BHAOMAI0TD8VDDReMToOOHEFQXIcY1cgAyFYIxcaM2cAFCIkYCRBJB5xDkgKM1geJxonBCUXMV9dLjAdSwMsJxo6ZgwCGSR0P0YoNHMAMx08RjAkDSF9Hx4GOl0kOA9DYyQzDgIAMBoON21VBRM0BBE4BzNwAyUdSwIvJCw2Yy4dCTB0Dj1tGEYJHztPWSIiByBdKyEhFX9SFBI1 HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stownrusis.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate