GET ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
23.36.77.97200 OK 17 kB URL User Request GET HTTP/2 ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
IP 23.36.77.97:443
ASN #20940 Akamai International B.V.
Certificate IssuerLet's Encrypt
Subjectak.lowmiloticer.com
Fingerprint16:BB:AB:73:07:C4:78:28:7F:3F:F0:35:F2:23:C9:F9:48:2E:BC:89
ValidityWed, 04 Dec 2024 11:17:05 GMT - Tue, 04 Mar 2025 11:17:04 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (18054)
Hash de657eb2062f9feabe64dcf162299dd3
4ec50c5479e0312b32bf2ae08d4607a9dc4918d9
1aa3a9ced02b1fb857e47a91773a8764f901d44ab2d76927d476da553e95f2ab
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
Quad9 DNS malicious Sinkholed
GET /afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1 HTTP/1.1
Host: ak.vialotadom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=utf8
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
vary: Accept-Encoding
x-akamai-transformed: 9 16708 0 pmb=mRUM,1
content-encoding: gzip
expires: Wed, 25 Dec 2024 22:04:25 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Wed, 25 Dec 2024 22:04:25 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 17292
server-timing: cdn-cache; desc=MISS, edge; dur=41, origin; dur=125, ak_p; desc="1735164264837_388255086_475536352_16768_1491_1_77_41";dur=1
X-Firefox-Spdy: h2
GET ak.vialotadom.com/sftouch?userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf&branchId=0&rb=JIAAI4Q8_u34g8wNegytNu0ZvGJXu3w-J49bPoxJNpS7CadupwRdoZNF1clZ0Drb1Xc7nBbX_Y0bHGAIjWC9Hu68l_ndotXLrNtdM_hlZaEGwbe8eRptrOl8LMn9fTPzZv-RSoc0YqZl991quYnM6T2QtAhGciESCXe46XUIRq-UWY2MYyRAS9JVp3MBnSEokFUdwa-9lqzGLYB8YvJVKtNPcbA_v_G1bWz4Edn7POLUblSuFsBjeYsRoxUFiLFw9oYNOYRwMPNyr4lJ&clksf=1&w_img=1
23.36.77.97200 OK 43 B URL GET HTTP/3 ak.vialotadom.com/sftouch?userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf&branchId=0&rb=JIAAI4Q8_u34g8wNegytNu0ZvGJXu3w-J49bPoxJNpS7CadupwRdoZNF1clZ0Drb1Xc7nBbX_Y0bHGAIjWC9Hu68l_ndotXLrNtdM_hlZaEGwbe8eRptrOl8LMn9fTPzZv-RSoc0YqZl991quYnM6T2QtAhGciESCXe46XUIRq-UWY2MYyRAS9JVp3MBnSEokFUdwa-9lqzGLYB8YvJVKtNPcbA_v_G1bWz4Edn7POLUblSuFsBjeYsRoxUFiLFw9oYNOYRwMPNyr4lJ&clksf=1&w_img=1
IP 23.36.77.97:443
ASN #20940 Akamai International B.V.
Requested by https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Certificate IssuerLet's Encrypt
Subjectak.lowmiloticer.com
Fingerprint16:BB:AB:73:07:C4:78:28:7F:3F:F0:35:F2:23:C9:F9:48:2E:BC:89
ValidityWed, 04 Dec 2024 11:17:05 GMT - Tue, 04 Mar 2025 11:17:04 GMT
File type GIF image data, version 89a, 1 x 1
Hash df3e567d6f16d040326c7a0ea29a4f41
ea7df583983133b62712b5e73bffbcd45cc53736
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /sftouch?userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf&branchId=0&rb=JIAAI4Q8_u34g8wNegytNu0ZvGJXu3w-J49bPoxJNpS7CadupwRdoZNF1clZ0Drb1Xc7nBbX_Y0bHGAIjWC9Hu68l_ndotXLrNtdM_hlZaEGwbe8eRptrOl8LMn9fTPzZv-RSoc0YqZl991quYnM6T2QtAhGciESCXe46XUIRq-UWY2MYyRAS9JVp3MBnSEokFUdwa-9lqzGLYB8YvJVKtNPcbA_v_G1bWz4Edn7POLUblSuFsBjeYsRoxUFiLFw9oYNOYRwMPNyr4lJ&clksf=1&w_img=1 HTTP/1.1
Host: ak.vialotadom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: image/gif
content-length: 43
x-trace-id: b5dfdf711db897f3decc58a1860f1c3e
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
expires: Wed, 25 Dec 2024 22:04:25 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Wed, 25 Dec 2024 22:04:25 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
server-timing: edge; dur=1, origin; dur=26, cdn-cache; desc=MISS, ak_p; desc="1735164265115_388255069_467301002_2607_983_-_-_-";dur=1
quic-version: 0x00000001
GET my.rtmark.net/img.gif?f=merge&userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf
188.114.97.1200 OK 43 B URL GET HTTP/2 my.rtmark.net/img.gif?f=merge&userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf
IP 188.114.97.1:443
Requested by https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Certificate IssuerGoogle Trust Services
Subjectmy.rtmark.net
Fingerprint8A:B7:CD:87:FA:39:07:A8:88:41:1C:9E:2D:0E:97:51:61:75:C1:34
ValidityWed, 06 Nov 2024 10:31:42 GMT - Tue, 04 Feb 2025 10:31:41 GMT
File type GIF image data, version 89a, 1 x 1
Hash b4491705564909da7f9eaf749dbbfbb1
279315d507855c6a4351e1e2c2f39dd9cd2fccd8
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
GET /img.gif?f=merge&userId=00813dc9a9ec4aa0e9a94cd5e9d076aa&z=5578752&p_rid=3d4f7767-c700-4594-9181-d21a6201550e&p_src=sf HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ak.vialotadom.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Dec 2024 22:04:25 GMT
content-type: image/gif
content-length: 43
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
set-cookie: ID=00813dc9a9ec4aa0e9a94cd5e9d076aa; expires=Thu, 25 Dec 2025 22:04:25 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHLy7m2Orr0pvM8VYI91fHl6qClIgtpQnM6GU%2FlM6rrrnYThhLd3B8%2FJvEH8%2F4IYtZGltha5Qh6vKwtHzDmqmg8mjnNy8NMVsIOkivAF5ge5JjxKzhXA4Bq4Kpo383Jk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8f7c2073a839b523-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1113&min_rtt=524&rtt_var=1214&sent=7&recv=11&lost=0&retrans=1&sent_bytes=3233&recv_bytes=1152&delivery_rate=7375212&cwnd=254&unsent_bytes=0&cid=0335696b1724644b&ts=56&x=0"
X-Firefox-Spdy: h2
GET ak.vialotadom.com/favicon.ico
23.36.77.97204 No Content 0 B URL GET HTTP/3 ak.vialotadom.com/favicon.ico
IP 23.36.77.97:443
ASN #20940 Akamai International B.V.
Requested by https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Certificate IssuerLet's Encrypt
Subjectak.lowmiloticer.com
Fingerprint16:BB:AB:73:07:C4:78:28:7F:3F:F0:35:F2:23:C9:F9:48:2E:BC:89
ValidityWed, 04 Dec 2024 11:17:05 GMT - Tue, 04 Mar 2025 11:17:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: ak.vialotadom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
pragma: public
cache-control: public, must-revalidate, proxy-revalidate, max-age=2592000
date: Wed, 25 Dec 2024 22:04:25 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
server-timing: cdn-cache; desc=HIT, edge; dur=32, origin; dur=0, ak_p; desc="1735164265657_388255069_467301193_3255_897_-_-_-";dur=1
quic-version: 0x00000001
POST ak.vialotadom.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e
23.36.77.97200 OK 12 B URL POST HTTP/3 ak.vialotadom.com/log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e
IP 23.36.77.97:443
ASN #20940 Akamai International B.V.
Requested by https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Certificate IssuerLet's Encrypt
Subjectak.lowmiloticer.com
Fingerprint16:BB:AB:73:07:C4:78:28:7F:3F:F0:35:F2:23:C9:F9:48:2E:BC:89
ValidityWed, 04 Dec 2024 11:17:05 GMT - Tue, 04 Mar 2025 11:17:04 GMT
Hash adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e HTTP/1.1
Host: ak.vialotadom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1494
Origin: https://ak.vialotadom.com
DNT: 1
Connection: keep-alive
Referer: https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-type: application/json; charset=utf-8
content-length: 12
access-control-allow-origin: https://ak.vialotadom.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
expires: Wed, 25 Dec 2024 22:04:25 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Wed, 25 Dec 2024 22:04:25 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
server-timing: edge; dur=1, origin; dur=26, cdn-cache; desc=MISS, ak_p; desc="1735164265726_388255069_467301284_2600_1414_-_-_-";dur=1
quic-version: 0x00000001
POST ak.vialotadom.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e
23.36.77.97200 OK 0 B URL POST HTTP/3 ak.vialotadom.com/async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e
IP 23.36.77.97:443
ASN #20940 Akamai International B.V.
Requested by https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Certificate IssuerLet's Encrypt
Subjectak.lowmiloticer.com
Fingerprint16:BB:AB:73:07:C4:78:28:7F:3F:F0:35:F2:23:C9:F9:48:2E:BC:89
ValidityWed, 04 Dec 2024 11:17:05 GMT - Tue, 04 Mar 2025 11:17:04 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /async_log/add?cid=1db9169f-90f4-4b2d-b517-bc47aab19c1f&ruid=3d4f7767-c700-4594-9181-d21a6201550e HTTP/1.1
Host: ak.vialotadom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 463
Origin: https://ak.vialotadom.com
DNT: 1
Connection: keep-alive
Referer: https://ak.vialotadom.com/afu.php?zoneid=8140693&var=8140693&rid=BPTR34PbLD67mf1dYD5JaA==&rhd=false&ab2r=0&sf=1&cs=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-length: 0
access-control-allow-origin: https://ak.vialotadom.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
expires: Wed, 25 Dec 2024 22:04:25 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Wed, 25 Dec 2024 22:04:25 GMT
alt-svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
server-timing: cdn-cache; desc=MISS, edge; dur=21, origin; dur=2, ak_p; desc="1735164265741_388255069_467301313_2328_799_-_-_-";dur=1
quic-version: 0x00000001