WEBSITE ANALYSIS REPORT

http://ww38.viedey.pro

18 Oct 2026 · 23:18:48.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

23:18:16.134 GET 200 document 39.0 KB 1171 ms 1 alerts

23:18:17.725 GET 200 script 144.3 KB 62 ms 1 alerts

23:18:17.739 GET 204 fetch 0 B 138 ms 1 alerts

23:18:17.744 GET 204 fetch 0 B 108 ms 1 alerts

23:18:17.881 GET 200 img 0 B 105 ms 1 alerts

23:18:17.949 GET 200 subdocument 26.6 KB 885 ms 1 alerts

23:18:17.987 POST 200 xhr 4.9 KB 197 ms 1 alerts

23:18:18.203 GET 200 img 43 B 36 ms 1 alerts

23:18:18.891 GET 200 img 43 B 152 ms 1 alerts

23:18:18.904 GET 200 script 1.3 KB 152 ms —

23:18:18.906 GET 200 script 487.7 KB 6456 ms —

23:18:18.914 GET 200 subdocument 70.7 KB 474 ms 2 alerts

Transaction #02

Request / response

URL

GET HTTPS

https://realtimesearchresults.com/sr/754870121/SAFEFRAME.html?ule=908&1P=&3zBeQl=Tv73O&5Jg1=&5T=&6BU=&6vlgg=4&73O1=76l&79T=RA1o41K%28%2AzlAK%2A%28A1K%2AKzlo%2Abso-4KK.ToAs&8BBQP=4&96BR3=bnWax-AWF%3AuwW%7C%2AlbW%3A1.HC9yCy9qCdq%7C%2AcbW%3Ay9DCqdCyyHC.%7CZnbW%3Ay9DCqdCyyHCyD1&9P9T=s&BPRl=Y4~bo&J3PBQ=s&JP8Q=s&K9T=&K9TUz=&KOl=&KTg2T=&Kl=s&OK13J9T=Uz&OQIy=&ORB=iM2r~f~_gMc%2F%2F_ycOcg%21pMrMcc1rf~yc%2FgO&OT7vO96=&OTB4=&OTBz=&OTU=&P9%21l=44A%28_ob.&PKTg2T=&PP3T=%7B%22PPRR%22%3A%22cZ%22%2C%22PPRBe%22%3A%22vePl6%22%2C%22PP9Q%22%3A%22%22%2C%22PPPR%22%3A%22~s%22%2C%22PP%219Q%22%3A%22%22%7D&PR=~s&Q9T=biZh4-0nb&R86vz=7PU%28N96BR&R86v~=.iZ4AG.%28-&R9T=bIwos-~%29S&RBQ9T=&RR=cZ&RTU=Z~-%28o&Rg9T=b%28bA4As.o&TlRvvv=&Tvg1=4&U9=4-.z~oA%28.b4%28bA4~4oA&aK9T=&eK6NRRNl_Q=&eQ3Q=&eTPQg=&glfyg3=8BBQ%3A%2F%2FU9lTleCQg7&htmlsrc=1&kkdd=HA%7C%21%7C%2An9hHuAW3&lRg9T=&pTQg=4&pTQgR6PB=&tpid=&vPQO=s&yPQl61=s&ypT=%28&eobd=&eoac=RvYbkNvbY&ure=1#vgd_sc=30&vgd_cmp_inj_fl=true&acl=&aclp=&cl=&clp=&hvsid=00001792365498724032757816326613&l2type=dmola&lp=%7B%22ppvi%22%3A%222153991109863524956%22%2C%22wlstp%22%3A%220%22%7D&matchstring=&pvl=%7B%22nmerr%22%3A%221%22%7D&pvlp=&sbdrId=&verid=&acid=undefined&mprpslog=3FpNqKGX_pjEn4vCi-RymSOxRhsx8kM3xdhudHqOZGU7hw7BqNhmHbuf4MgLExEGAYFaPsYXG9uOQz3Bpf-zye0UuMD-giLsKaTplKn3Kvp9Dszx6UZoSien5yrj-S7DAqfTb1_hbj43887K7UcmiQdKU6Rkdvwk7JR_HGflV0kjE-0GSE5wn6_IpQaJSetyADy5DfW9nPI%3D&tchkpts=%7B%22prel2%22%3A1792365498909%7D&stime=1792365498909&l3d=%257B%2522l2host%2522%253A%2522https%253A%252F%252Frealtimesearchresults.com%252Fsr%252F754870121%252FSAFEFRAME.html%253F.GmdV%253D_%252528Th~r7Tq%25253AltT%25257CUF_T%25253ABvck.OkO.3kg3%25257CUR_T%25253AO.-k3gkOOckv%25257CS%252528_T%25253AO.-k3gkOOckO-B%2526.n.2%253DD%252602nbw%253D%25260NG%252529dd%252529Ffb%253D%25260bVb%253D%25262FdMMM%253D%25262MwB%253DP%2526Bn%253D%2526Fdw.2%253D%2526GMFww%253DP%2526Gmx%253D%2526I2%253D%2526IewB%253D%2526J2bw%253DP%2526J2bwdGnm%253D%2526MnbZ%253DD%2526N.2%253D%2526N.2x%252521%253D%2526N2wQ2%253D%2526NF%253DD%2526NZF%253D%2526OJ2%253Di%2526OnbFGB%253DD%2526V%252521m0bF%253D2MaVZ%2526Z2aMZ.G%253D%2526Z2m%252521%253D%2526Z2mP%253D%2526Z2x%253D%2526ZNBVe.2%253Dx%252521%2526Zb%25252AO%253D%2526Zdm%253DC4QHEKEfw4R%25252F%25252FfORZRw8J4H4RRBHKEOR%25252FwZ%2526a.2%253Dd7BjPBNiU%252521F7NUi7BNUN%252521FjU_DjrPNNv2j7D%2526aVZB%253DaGF%2526b.2%253D_CSzPro%252528_%2526d.2%253D_%25252AtjDrEL1%2526d2x%253DSErij%2526dd%253DRS%2526dmb.2%253D%2526duGM%252521%253Danxi%252529.Gmd%2526duGME%253DvCSP7yvir%2526dw.2%253D_i_7P7Dvj%2526eVnmb%253DD%2526enub%253DD%2526hN.2%253D%2526htmlsrc%253D1%2526kkdd%253D%25252Au%25257C%252521%25257C3WHAhnu9%25252A%2526mndF%253DXPE_j%2526n.8F%253DPP7ifj_v%2526nN2wQ2%253D%2526nd%253DED%2526nnV2%253D%25257B%252522nndd%252522%25253A%252522RS%252522%25252C%252522nndm0%252522%25253A%252522M0nFG%252522%25252C%252522nn.b%252522%25253A%252522%252522%25252C%252522nnnd%252522%25253A%252522ED%252522%25252C%252522nn8.b%252522%25253A%252522%252522%25257D%2526tpid%253D%2526ummbn%253DP%2526wFKOwV%253Dummb%25253A%25252F%25252Fx.F2F0kbwa%2526x.%253DPrv%252521Ej7iv_Pi_7PEPj7%2522%252C%2522be%2522%253A%25220%2522%252C%2522nmerr%2522%253A%25221%2522%257D&infr=1&twna=1

IP / ASN

104.21.11.124

AS13335 · CLOUDFLARENET

Requested by: https://yfdpco7.com/sk-park.php?pid=9PO15V947&dn=viedey.pro&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A134.0%29+Gecko%2F20100101+Firefox%2F134.0&ip=195.64.118.0&xfip=195.64.118.0&requrl=http%3A%2F%2Fww38.viedey.pro%2F&al=en-US%2Cen%3Bq%3D0.9

Resource information

File type: HTML document, ASCII text, with very long lines (43832), with CRLF, LF line terminators
MIME type: text/html
First seen (UTC): 18 Oct 2026 · 23:18:57.225 UTC
Last seen (UTC): 18 Oct 2026 · 23:18:57.225 UTC
Times seen: 1

Size: 70.7 KB (72414 bytes)
MD5: 7fc0a5bbb49fafdf89fcb33f04126e0d
SHA1: 787b8a9ee23870879dc47f1a179f7b77f1e54e08
SHA256: c4b2bdb40a6f16f6094c36e224f7e8498f186f98f22692b120619f6b80d25882

Certificate information

Issuer: Let's Encrypt · YE2
Subject: realtimesearchresults.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: 7F:DE:6A:DA:A3:AA:BB:E4:18:F8:BE:CF:AD:99:5D:CD:4A:30:D2:EA
Valid from: Tue, 01 Sep 2026 13:02:15 GMT
Valid until: Mon, 30 Nov 2026 13:02:14 GMT

Technology fingerprints

Google Cloud CDN (CDN)
Google Cloud (IaaS)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /sr/754870121/SAFEFRAME.html?ule=908&1P=&3zBeQl=Tv73O&5Jg1=&5T=&6BU=&6vlgg=4&73O1=76l&79T=RA1o41K%28%2AzlAK%2A%28A1K%2AKzlo%2Abso-4KK.ToAs&8BBQP=4&96BR3=bnWax-AWF%3AuwW%7C%2AlbW%3A1.HC9yCy9qCdq%7C%2AcbW%3Ay9DCqdCyyHC.%7CZnbW%3Ay9DCqdCyyHCyD1&9P9T=s&BPRl=Y4~bo&J3PBQ=s&JP8Q=s&K9T=&K9TUz=&KOl=&KTg2T=&Kl=s&OK13J9T=Uz&OQIy=&ORB=iM2r~f~_gMc%2F%2F_ycOcg%21pMrMcc1rf~yc%2FgO&OT7vO96=&OTB4=&OTBz=&OTU=&P9%21l=44A%28_ob.&PKTg2T=&PP3T=%7B%22PPRR%22%3A%22cZ%22%2C%22PPRBe%22%3A%22vePl6%22%2C%22PP9Q%22%3A%22%22%2C%22PPPR%22%3A%22~s%22%2C%22PP%219Q%22%3A%22%22%7D&PR=~s&Q9T=biZh4-0nb&R86vz=7PU%28N96BR&R86v~=.iZ4AG.%28-&R9T=bIwos-~%29S&RBQ9T=&RR=cZ&RTU=Z~-%28o&Rg9T=b%28bA4As.o&TlRvvv=&Tvg1=4&U9=4-.z~oA%28.b4%28bA4~4oA&aK9T=&eK6NRRNl_Q=&eQ3Q=&eTPQg=&glfyg3=8BBQ%3A%2F%2FU9lTleCQg7&htmlsrc=1&kkdd=HA%7C%21%7C%2An9hHuAW3&lRg9T=&pTQg=4&pTQgR6PB=&tpid=&vPQO=s&yPQl61=s&ypT=%28&eobd=&eoac=RvYbkNvbY&ure=1 HTTP/1.1
Host: realtimesearchresults.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-Fetch-Storage-Access: none
Sec-GPC: 1
Connection: keep-alive
Referer: https://yfdpco7.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Priority: u=4
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
date: Sun, 18 Oct 2026 23:18:19 GMT
content-type: text/html
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-store, max-age=0
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vlK%2B3JlcSW3JY8kyPVKhkoo5NQJqzLXRdi3iw83MGVOUfJoI765LfmzDp9tUgeS6ApFYIg2%2ByJFvyXLEnCw8FOptksGH0KE2yz%2BmWOK68QgfsDzPbC7RteP7lV4SlEha7O00CcfvygPPQQzZ"}]}
link: <https://scripts.clarity.ms/0.8.54/clarity.js>; rel=prefetch, <https://msadsscale.microsoft.com/bingads/telemetryJS.js>; rel=prefetch, <https://www.clarity.ms>; rel=dns-prefetch, <https://s.yimg.com/ds/scripts/selectTier-p1.1.0.js>; rel=prefetch
x-sc-h: 21-4q3p
via: 1.1 google
cf-cache-status: DYNAMIC
vary: accept-encoding
content-encoding: zstd
cf-ray: a4cb42f05a227130-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

23:18:19.073 GET 200 script 1.3 KB 38 ms —

23:18:19.117 GET 200 script 9.7 KB 40 ms —

23:18:19.167 GET 200 script 235.9 KB 12 ms —

23:18:19.200 POST 200 xhr 0 B 39 ms 1 alerts

23:18:19.436 GET 200 img 283 B 24 ms 1 alerts

23:18:19.453 GET 200 img 17.6 KB 14 ms 1 alerts

23:18:19.478 GET 200 font 17.9 KB 14 ms 1 alerts

23:18:19.686 GET 200 script 15 B 133 ms 1 alerts

23:18:20.688 GET 200 img 15 B 134 ms 1 alerts

23:18:21.204 POST 200 xhr 0 B 37 ms 1 alerts

23:18:23.211 POST 200 xhr 0 B 40 ms 1 alerts

23:18:25.795 GET 200 img 43 B 41 ms —

23:18:25.817 GET 200 img 43 B 38 ms —

23:18:25.822 GET 200 img 2.2 KB 2 ms —

23:18:25.833 GET 200 img 43 B 39 ms —

23:18:28.237 POST 200 xhr 0 B 38 ms 1 alerts

23:18:33.246 POST 200 xhr 0 B 37 ms 1 alerts

http://ww38.viedey.pro

Domain graph

Hostnames

Connections