| r10.o.lencr.org/ |  23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashb6ecb6018a51380d08a47460236a395c 1ce7fe77c21188624302a660a289fe1ce6e7a9e4 ec876edd163ea26b47c9b862c795844f5dd01452095287ea5cd920e3b512672a
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "EC876EDD163EA26B47C9B862C795844F5DD01452095287EA5CD920E3B512672A"
Last-Modified: Wed, 25 Sep 2024 21:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15035
Expires: Thu, 26 Sep 2024 03:20:24 GMT
Date: Wed, 25 Sep 2024 23:09:49 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hasha5b959f6361bd2268ea797981fc39820 a2dcec6766e9f4208fbb3d7d36480685f4da699d a772ec396492ebb0e8b9dbfda8897bc3ce70ad8184b7d99c600cd6b4abefcce1
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A772EC396492EBB0E8B9DBFDA8897BC3CE70AD8184B7D99C600CD6B4ABEFCCE1"
Last-Modified: Wed, 25 Sep 2024 18:43:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16285
Expires: Thu, 26 Sep 2024 03:41:14 GMT
Date: Wed, 25 Sep 2024 23:09:49 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashe49ce6a2ffd1afe9fdb15fd32491f4c5 7def7bdba49613d39e69a640fbe216a4ffee38cb 6ddbcc3388c5458c7be8c867cbff8d6ae16d588349605db0c7b5996ea32de452
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "6DDBCC3388C5458C7BE8C867CBFF8D6AE16D588349605DB0C7B5996EA32DE452"
Last-Modified: Wed, 25 Sep 2024 19:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7768
Expires: Thu, 26 Sep 2024 01:19:17 GMT
Date: Wed, 25 Sep 2024 23:09:49 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashc5df97c10e9a37c02e8e12b302465464 b0d9b31bb7dd48f11b58e6f1833798e45dc5a862 350fb41eb348dc3b30943b357e089a3cd9dcc9670285c29485ba02a38ebcbc15
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "350FB41EB348DC3B30943B357E089A3CD9DCC9670285C29485BA02A38EBCBC15"
Last-Modified: Wed, 25 Sep 2024 02:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13908
Expires: Thu, 26 Sep 2024 03:01:37 GMT
Date: Wed, 25 Sep 2024 23:09:49 GMT
Connection: keep-alive
|
|
| |  44.193.97.228 | 301 Moved Permanently | 0 B |
URL User Request GET HTTP/2IP44.193.97.228:443
CertificateIssuerAmazon Subjectrb.gy FingerprintBB:79:B9:1E:EB:C8:D9:F9:99:32:F6:BF:06:0B:86:80:7E:DB:DF:FD ValidityFri, 19 Jul 2024 00:00:00 GMT - Sat, 16 Aug 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /af9uw3 HTTP/1.1
Host: rb.gy
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Wed, 25 Sep 2024 23:09:50 GMT
content-length: 0
location: https://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email
cache-control: no-cache, no-store
expires: -1
engine: Rebrandly.redirect, version 2.1
strict-transport-security: max-age=15552000
X-Firefox-Spdy: h2
|
|
| ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email |  104.21.41.17 | 301 Moved Permanently | 6.6 kB |
URL User Request GET HTTP/1.1ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email IP104.21.41.17:80
File typeHTML document, ASCII text, with very long lines (9772), with no line terminators Hash36d53058a04ae01ec66f659a05dfbaee a46fc5ff59e06549bb8b7636c252b58c8e818698 c0ac41e7a4d2ba405ba4789c8788ee00f59078ec8b869ccec9b5165440637aaa
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email HTTP/1.1
Host: ath8l.gvyffexiup.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Wed, 25 Sep 2024 23:09:50 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: XddgruakpezcNGRfeLvyy5zLZ/T6DhQwwlMfuxG1GjGAOXFYiP2mnz65Ik3UAuLEP6d9JtQanfu4ttOSzr4vFL8RCAiQJ55sUBVrvT+sk9UCXjTlGx5lnovmqkaKj7FaTPwZrQfmH2P8iI/y2MZd4g==$3le5qT1bHlQqt+nFXKZDog==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GHoE1AoOa78PbW2JSfdW8XANL8h9US7rWHgpQBOAOr0g0uPPdCtKDy%2FEYyWzb7Nh%2FrHwxM5%2BmOpL5a%2BTX7ZM3y6%2BnnDypC6QfB0jBz3kMbW7gnexBVkwqnDUzQyMZj8sNrwSfChDFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 8c8eaf26f828712a-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.18.94.41 | 200 OK | 61 B |
URL GET HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:51 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 8c8eaf2be9e656b5-OSL
X-Firefox-Spdy: h2
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashc1ff601f62931f3c9b84ea31d1ea35c6 01098cc4d1660ce674992cd4d666e0c794d9f8a6 86b8145813126e00f5fc0c5fa7f241c6687020c67a796e6a5d3b0688c2e74473
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "86B8145813126E00F5FC0C5FA7F241C6687020C67A796E6A5D3B0688C2E74473"
Last-Modified: Wed, 25 Sep 2024 12:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3310
Expires: Thu, 26 Sep 2024 00:05:01 GMT
Date: Wed, 25 Sep 2024 23:09:51 GMT
Connection: keep-alive
|
|
| ath8l.gvyffexiup.top/favicon.ico | 104.21.41.17 | 403 Forbidden | 6.0 kB |
URL GET HTTP/2ath8l.gvyffexiup.top/favicon.ico IP104.21.41.17:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectgvyffexiup.top Fingerprint01:55:AA:48:9E:60:A2:24:9A:C0:CE:87:08:F5:1F:B9:87:61:CA:2C ValidityThu, 01 Aug 2024 11:05:31 GMT - Wed, 30 Oct 2024 11:05:30 GMT
File typeHTML document, ASCII text, with very long lines (8278), with no line terminators Hash4c585c2ca96fec70b3e7043986ec8736 7603263d30dc5d538ff193e7852c0ecc0f1d56f0 ae7cec91eebbc4cc3bedfb8d52e96412774b3f9dc2999ec85bffd3f330738318
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: ath8l.gvyffexiup.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email&__cf_chl_rt_tk=3vUX1deQ7iLpNeiD7l3aRgRl_kj6oficA1NuSDTfcds-1727305790-0.0.1.1-4009
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 403 Forbidden
date: Wed, 25 Sep 2024 23:09:50 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: Ar10I9APXOMZul8DKfDI4QdQDJ+VTUU0LU+02tkNB1G2CXrdg9o+ln9om48sptAy5Hbp44Q+LolyFbQvyfXK4KZD+ZOTxOAxT+irLAvGlxr9oaDHPkU/nU9zTg2u75OOgZnjz9OvBWZ183OO6OXJVQ==$K9rsUe1KrCFpdpaSRFYV9w==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZdsybK0lhvq3NmrjQIIbQovYiJa9IzMOY96t1ViatbNJRs5x7f3lM0YRVnf6fAs%2B8I7mpaLWKRBOna%2BrYY90hlhuipIa9t9323mxVWzIotJdMmJ9a3wBL3SOHg2lD6v6Y4E4wxOp0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 8c8eaf28d98b712a-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashc1ff601f62931f3c9b84ea31d1ea35c6 01098cc4d1660ce674992cd4d666e0c794d9f8a6 86b8145813126e00f5fc0c5fa7f241c6687020c67a796e6a5d3b0688c2e74473
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "86B8145813126E00F5FC0C5FA7F241C6687020C67A796E6A5D3B0688C2E74473"
Last-Modified: Wed, 25 Sep 2024 12:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3310
Expires: Thu, 26 Sep 2024 00:05:01 GMT
Date: Wed, 25 Sep 2024 23:09:51 GMT
Connection: keep-alive
|
|
| r11.o.lencr.org/ | 23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hashc1ff601f62931f3c9b84ea31d1ea35c6 01098cc4d1660ce674992cd4d666e0c794d9f8a6 86b8145813126e00f5fc0c5fa7f241c6687020c67a796e6a5d3b0688c2e74473
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "86B8145813126E00F5FC0C5FA7F241C6687020C67A796E6A5D3B0688C2E74473"
Last-Modified: Wed, 25 Sep 2024 12:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3310
Expires: Thu, 26 Sep 2024 00:05:01 GMT
Date: Wed, 25 Sep 2024 23:09:51 GMT
Connection: keep-alive
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ | 104.18.94.41 | 200 OK | 50 kB |
URL GET HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ IP104.18.94.41:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typeHTML document, ASCII text, with very long lines (42605) Hashe39fda1252df72ed23712dab5a5e058e 356d05199e960daa56fb5fdb25115b13b9ebd13b 6f9e807f0139b1da613dae2bc038616c43f57d23e1be53920c165172ec435ed3
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:51 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
cross-origin-resource-policy: cross-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
origin-agent-cluster: ?1
document-policy: js-profiling
referrer-policy: same-origin
cross-origin-opener-policy: same-origin
server: cloudflare
cf-ray: 8c8eaf2b296656b5-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c8eaf2b296656b5/1727305791653/500e90352a5ca788c2496e7b20fd57890f171a33f1534d244079250022ae8f4d/38XDHobtWD1mltu | 104.18.94.41 | 401 Unauthorized | 1 B |
URL GET HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c8eaf2b296656b5/1727305791653/500e90352a5ca788c2496e7b20fd57890f171a33f1534d244079250022ae8f4d/38XDHobtWD1mltu IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typevery short file (no magic) Hashff44570aca8241914870afbc310cdb85 58668e7669fd564d99db5d581fcdb6a5618440b5 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/g/pat/8c8eaf2b296656b5/1727305791653/500e90352a5ca788c2496e7b20fd57890f171a33f1534d244079250022ae8f4d/38XDHobtWD1mltu HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 401 Unauthorized
date: Wed, 25 Sep 2024 23:09:53 GMT
content-type: text/plain; charset=UTF-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gUA6QNSpcp4jCSW57IP1XiQ8XGjPxU00kQHklACKuj00AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAxpIQ8pg8hGd05KbJAkG1a7AHXWPHRpWvRWN4TyfS8G5mZIlaiyy15YT2ap9ucvVm0bPpNpyuVfHCX_nw5MPtOD2MWJTk-yMwq2EaiuOL9_hyR3JykLG25Q3Ruso08zUTfbqJ0t0I-7NomwvbG0PF3ARFppsmMmybE6qG5uyioR_eYlS0ULfDDo6jfgi4aiXhLCJwFcqRseNeOyWf-DwIm7B_zmu-FA_mCJlWAHA6EFEZ81LhYq4GVjl7_TfusSIr4rvWhY0ogvq8h4etid-jqlO_Ao4NBNrQZHXdevq3QTM9JoPBera0p3bX0nVHsPnunZX9gnHhG3Kr_OJUrC41lQIDAQAB", max-age=20, PrivateToken challenge="AAIAHXNhdC5wYXQtaXNzdWVyLmNsb3VkZmxhcmUuY29tIFAOkDUqXKeIwklueyD9V4kPFxoz8VNNJEB5JQAiro9NABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAsLS4HBnLGydwK-bLQGRCaoyMsrXBRrDgQVmxS06j3UF0nYSd6GdTGCKIu1WV60eg-tJtTttfEVq7wHVQf4vzjYBidmCh88ebzxKv2GB6PESSodf5MsEup9xd5dxpkYScgL1CCJq89kRrOQ_CS61bvkL_oGyZf4ffqG5THgaOsopqj8dFLH6_SMy9yf8EgMYqpyjxfKsD-1_qb1m1DRjJEKPWKIGwmHXIKQJUqsxZFm4_Inwkxx7QMpVP4GyqlTxFVz7stWwJRSkMLHjEM_IWLUYfPhuwIUVqmRjGsY1n8flA1bRfxaWHNDxoi25-M2BKTP9NkNNJBbTKErhrZ9LGywIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIFAOkDUqXKeIwklueyD9V4kPFxoz8VNNJEB5JQAiro9NABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAuJroJOc-tyeoeQjFgfJ8GZidY1pYZ3E6vnRPKA0M4VuvYINC4ZmqLOQzac3aJzNuRrxrQ8vCXrvu97kqdHJSuD7c4F3hVN6pS2ay8sAL7u7jJt6lacsQHuSPC9EIde0igAXxPC2mDw7WVmKBnW1L8eX49fv385hVn2lkvVbn6g2RCo-8cr_vCaywLT1Y4m5m_6XjP6Oekt71A2a9NKotkb81Y8DjanuZ8fdTQWt6O8NqyhDobyHRcF9-9o8acjcIRT5cfkSGzFdMpznnIFdDtr33BOQv2usHcnClM6om78iaqVMykh3JylHkrYXv9gOBIy3r8i0wOr_0t9XKtgxipQIDAQAB", max-age=20
server: cloudflare
cf-ray: 8c8eaf3bbe9356b5-OSL
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c8eaf2b296656b5/1727305791655/OkNb6NRzo3c5OBQ | 104.18.94.41 | 200 OK | 61 B |
URL GET HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c8eaf2b296656b5/1727305791655/OkNb6NRzo3c5OBQ IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typePNG image data, 48 x 67, 8-bit/color RGB, non-interlaced Hash60e63c1ce940bb5de85e20e02d5880dd 36875aa9ae31f7351f02cabb986eb970a0aace3d 9a7a2e71fa238186da55988d58ded5d3e1d2d782b3741d0e7649a1428ed4a21f
GET /cdn-cgi/challenge-platform/h/g/i/8c8eaf2b296656b5/1727305791655/OkNb6NRzo3c5OBQ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:53 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 8c8eaf3c6f9a56b5-OSL
X-Firefox-Spdy: h2
|
|
| ath8l.gvyffexiup.top/favicon.ico | 104.21.41.17 | 403 Forbidden | 26 kB |
URL GET HTTP/2ath8l.gvyffexiup.top/favicon.ico IP104.21.41.17:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectgvyffexiup.top Fingerprint01:55:AA:48:9E:60:A2:24:9A:C0:CE:87:08:F5:1F:B9:87:61:CA:2C ValidityThu, 01 Aug 2024 11:05:31 GMT - Wed, 30 Oct 2024 11:05:30 GMT
File typeHTML document, ASCII text, with very long lines (8192), with no line terminators Hashb8c56cdc3b16c584a35da8d7849108cf 463003a2186b22a5b73102099b03aa5a04f5aee9 5be36fa589f18464928b62d58158701f83dcf05a8d7c4a42369d9303f7adb298
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: ath8l.gvyffexiup.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 403 Forbidden
date: Wed, 25 Sep 2024 23:09:50 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-content-options: nosniff
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: L4V++cc3Q7tc9bbjnfL3//I5mQR7NOkKxPfNlWkfDMYcEVeGozckr2d4DKf7EUCb2mCUCccMoiofzankTkYHDiNzcbNpL695Ano40fB9ICYG/tg46oSAbOrc65XBBo+xeEOXc+Em+8zaekuzdiRUfg==$Nny+K2W6YnCPRM1MQ78eIg==
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MA42L7gUflujLboR5JiFD5aXVszjxS1leM31Hmq7DHBjR7xLoNYU%2B6jFGX2IGHR89PKwDzPg8pB0GRrQhRC6c3sm7FsaAWMvLmRjBoWbde5i0DtmG5kInCB6dSkYfXHWInYG%2FgWFcg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 8c8eaf2919b6712a-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ath8l.gvyffexiup.top/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c8eaf27f8eb712a | 104.21.41.17 | 200 OK | 158 kB |
URL GET HTTP/2ath8l.gvyffexiup.top/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c8eaf27f8eb712a IP104.21.41.17:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectgvyffexiup.top Fingerprint01:55:AA:48:9E:60:A2:24:9A:C0:CE:87:08:F5:1F:B9:87:61:CA:2C ValidityThu, 01 Aug 2024 11:05:31 GMT - Wed, 30 Oct 2024 11:05:30 GMT
File typeHTML document, ASCII text, with very long lines (65536), with no line terminators Size158 kB (158031 bytes) Hashb166cc6aebca9952c8204a2717cfd61e 6a2ffb20ad33c32b1b9834b00b78422aaf423be3 b675c5ab10d2bdbe1dd20c14efe456568bc4bf28f3c4aed4388b3da4740fcaa0
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c8eaf27f8eb712a HTTP/1.1
Host: ath8l.gvyffexiup.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email&__cf_chl_rt_tk=3vUX1deQ7iLpNeiD7l3aRgRl_kj6oficA1NuSDTfcds-1727305790-0.0.1.1-4009
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:50 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wzBpkLifjAVFMwZDZLdeBeZ%2FCxu9kHiAj2obaV2LUZ3E6wlro%2BZzZtNYJYDjX%2FY2D5xBFl0jQwnyw3X%2BuHE5k5nXXmkSx%2Fk%2BjrYpWeeCTMRqEiIdtTFnnlfncxsq1kI8BuLd%2FZz6%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8c8eaf28c980712a-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js?onload=Jeuhg1&render=explicit | 104.18.94.41 | 200 OK | 47 kB |
URL GET HTTP/2challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js?onload=Jeuhg1&render=explicit IP104.18.94.41:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typeJavaScript source, ASCII text, with very long lines (47261) Hashe07e7ed6f75a7d48b3df3c153eb687eb 4601d83c67cc128d1e75d3e035fb8a3bdfa1ee34 96bd1c81d59d6ac2ec9f8ebe4937a315e85443667c5728a7cd9053848dd8d3d7
GET /turnstile/v0/g/ec4b873d446c/api.js?onload=Jeuhg1&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ath8l.gvyffexiup.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:50 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 17 Sep 2024 16:06:37 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8c8eaf2948de5689-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ath8l.gvyffexiup.top/cdn-cgi/challenge-platform/h/g/flow/ov1/1414200516:1727302371:rmu58neH0j74TfPDnrcqncMWIVmMFlf_T1GbyAEnbfI/8c8eaf27f8eb712a/9c2bbb8a7483ec9 | 104.21.41.17 | 200 OK | 17 kB |
URL POST HTTP/2ath8l.gvyffexiup.top/cdn-cgi/challenge-platform/h/g/flow/ov1/1414200516:1727302371:rmu58neH0j74TfPDnrcqncMWIVmMFlf_T1GbyAEnbfI/8c8eaf27f8eb712a/9c2bbb8a7483ec9 IP104.21.41.17:443
Requested byhttps://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email CertificateIssuerGoogle Trust Services Subjectgvyffexiup.top Fingerprint01:55:AA:48:9E:60:A2:24:9A:C0:CE:87:08:F5:1F:B9:87:61:CA:2C ValidityThu, 01 Aug 2024 11:05:31 GMT - Wed, 30 Oct 2024 11:05:30 GMT
File typeASCII text, with very long lines (16908), with no line terminators Hash3e5a9656b9ea3b8fd61fb434904a1365 3ba39aca5fcc6921f7fbda3422aa892bbcde3f71 9768218e20444ecfdfa0c4662098d1e9fce50a0dc5df76a7c0d3b9d5fd6f6850
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1414200516:1727302371:rmu58neH0j74TfPDnrcqncMWIVmMFlf_T1GbyAEnbfI/8c8eaf27f8eb712a/9c2bbb8a7483ec9 HTTP/1.1
Host: ath8l.gvyffexiup.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://ath8l.gvyffexiup.top/?utm_campaign=digest_email&target_user_id=16014965&click_source=suggested_user_cta&utm_source=instagram&utm_medium=email
Content-type: application/x-www-form-urlencoded
CF-Challenge: 9c2bbb8a7483ec9
Content-Length: 2117
Origin: https://ath8l.gvyffexiup.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:51 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: nY6NdTG3Bt/sd1NgkAP/tkuYI6cMqFoxF4sChX0I33NxRBYeTWpMY7SoqvRYok0retxe67yAKA==$TYWayqYYoJ7BiyZG
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AbidQJrLcT7YzLux3PPv%2F7WVMEfOJV2SLghfgJOZ4J1UfyOkA2Jp7AAt%2FYomOjdvFh9LUZndBWe6Fbgoz%2F6avCO73VqsgQ7%2Fpc%2F%2B64HPfu2X4s7TMXKh5dl7dViEQ7%2FMxZ9PSy0ZEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8c8eaf2a0a6e712a-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8eaf2b296656b5&lang=auto | 104.18.94.41 | 200 OK | 120 kB |
URL GET HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8eaf2b296656b5&lang=auto IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size120 kB (119964 bytes) Hash8434cdd3d9266fa7a5cd0d62bcc70aa4 5388f741da7d394dae373ff328c9903ab1ea3095 3f4764ee29cfece2407a79168353b348333e783f7ce8529b25b6672f267f09bb
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c8eaf2b296656b5&lang=auto HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:51 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server: cloudflare
cf-ray: 8c8eaf2bf9e856b5-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c | 104.18.94.41 | 200 OK | 139 kB |
URL POST HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size139 kB (139136 bytes) Hash3852f4a24f5c1264d232448dee257469 8f6d89a474f1b6e3e6ec77aac2874f26d1424537 80f193a2b6e8ac98d2c72fe99b2dfeeff6f2739f91d82a82ae8553eb486849d7
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Content-type: application/x-www-form-urlencoded
CF-Challenge: 1432321fd79b81c
Content-Length: 3804
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:51 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: z6Zi42/pmxZulht815BLHadKNVMH7k/O7W4jBSygrXoM6ihrGMD90Gu5QsPq+Tpn2ph0BW3b/yxAUqLwNWvlNgRhlalijOHBIFBxMWgpexPBJZ34lKipDwKtcM8Rh0T5Rq1KQibI+WOqREJbFNyfWivkSc6/7lHF/3fIJ/ZMy65PHYJFQM3kx+M/woThKff2gxS6euhmkTMHKhbyyMgiqzwC+M1VDe4mnzZmO/sHot7lHqSsnd1S9LIgLynuYyyWoa0c45XUuueqHS4TgbWYskBOd9qUuQJI3TeIuD3RThWCX71OZhJ1YBIJs8kLsNq7skG/1f6PtW6mx36kw5ugFcneMVcgZckoGxsO3pTvhWDkSJe1hvcTNU+6ddnQjtEt3ed1dXjuvgUSLV5iAjS+spPx/kG/f9JcV/XHvb7T6eJuKMLwJOF+vztUROvVdap8kw0OL4AQh7r8sEVkpQ==$RbGQvhC5ZhuLz/s2
server: cloudflare
cf-ray: 8c8eaf2dbb4856b5-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c | 104.18.94.41 | 200 OK | 27 kB |
URL POST HTTP/2challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c IP104.18.94.41:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ CertificateIssuerGoogle Trust Services Subjectchallenges.cloudflare.com Fingerprint65:75:A9:DF:EC:98:9B:14:E5:F1:43:E6:B9:E2:E3:9C:50:C4:E8:A4 ValidityThu, 05 Sep 2024 16:26:55 GMT - Wed, 04 Dec 2024 17:26:54 GMT
File typeASCII text, with very long lines (26832), with no line terminators Hash3b8f42a7487c91ddda25e6c12bf7dde3 c7742790d47856209b1ee1721fe27062e55efbc3 15b6497809b8171bf99051e2b056e23cd4c2e76e9b8d07498b77463251aea829
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/440758502:1727302410:uGOX5tzsouih9nM3Y2_Z2xRB9uCaU83x3Oh2ifhKS9I/8c8eaf2b296656b5/1432321fd79b81c HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/eodkv/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Content-type: application/x-www-form-urlencoded
CF-Challenge: 1432321fd79b81c
Content-Length: 29106
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 25 Sep 2024 23:09:54 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: xf2TejbWbBv8d8AXKGOuKVCRJN1jz1XXlD6HhXxqAw+Hy3F49P4IUzg2AHgjMTZTvlO+/Lj/+6dAUl7w$aMAigRfvPxuBkHe3
server: cloudflare
cf-ray: 8c8eaf405b5156b5-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|