Report - youareanidiot.cc/lol.html

Report Overview

Visited public
2023-12-30 09:30:37
Tags
URL
youareanidiot.cc/lol.html
Finishing URL
youareanidiot.cc/lol.html
IP / ASN
104.21.95.69
#13335 CLOUDFLARENET
Title
You are an Idiot!

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
youareanidiot.cc	unknown	2020-05-29	2022-01-18 10:20:17	2023-12-23 23:09:26	2.8 kB	273 kB	104.21.95.69

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-30 09:30:16	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-30 09:30:16	medium	Client IP	Internal IP	ET DNS Query for .cc TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-12-30	medium	youareanidiot.cc	Sinkholed
2023-12-30	medium	youareanidiot.cc	Sinkholed
2023-12-30	medium	youareanidiot.cc	Sinkholed
2023-12-30	medium	youareanidiot.cc	Sinkholed
2023-12-30	medium	youareanidiot.cc	Sinkholed
2023-12-30	medium	youareanidiot.cc	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	From	Size	First Seen	Last Seen
	youareanidiot.cc/scripts/math.js	ScriptElement	1.2 kB	2023-12-01	2025-06-07
Pretty URL youareanidiot.cc/scripts/math.js IP 104.21.95.69 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-01 17:01 Last Seen2025-06-07 12:46 Times Seen45 Hash 91a6ca262b43459c5ffc7d26dd7ec517 65fc0670eb58bbc3697926813712b0edf4c57778 7a68a5e6ad9128312249540e6fff8a369b953fcf8cd668a64b357e659b37b817 Loading...

	youareanidiot.cc/scripts/lol.js	ScriptElement	503 B	2023-12-30	2025-05-19
Pretty URL youareanidiot.cc/scripts/lol.js IP 104.21.95.69 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-12-30 10:30 Last Seen2025-05-19 19:58 Times Seen5 Hash 790c1b2b06aa85e813b9c203a15d1827 e56b220da7111f339db4f716ce23ffeb60c5c7bb a64245f6e396f1f026efc23d0d8c454edaedf2c8074167945b92802eee05fce3 Loading...

HTTP Transactions (6)

URL IP Response Size

youareanidiot.cc/styles/styles.css

104.21.95.69

200 OK

2.1 kB

URL GET HTTP/3
youareanidiot.cc/styles/styles.css
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Requested by
https://youareanidiot.cc/lol.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type
ASCII text
Size
2.1 kB (2100 bytes)
Hash
ed96e327dc9d8338c9e8c83ec72ab5e1
d4023cc8f7e294f28328366af2044e7fc0e2e615
6fa264b7e5e4758facd452a22af99a6a5a3fc9c877a597b03be5756b206bd12c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /styles/styles.css HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://youareanidiot.cc/lol.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 30 Dec 2023 09:30:17 GMT
content-type: text/css; charset=utf-8
content-length: 2100
last-modified: Wed, 13 Sep 2023 10:48:59 GMT
etag: "6501939b-834"
cache-control: public, max-age=31536000, no-transform, immutable
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1413066
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N8jAAK%2F1TN3b1ilitNmPPdyCUhm5qIEJNhdEtqLg8%2BGlrYhXHXsv3OLp4geQwqrAlCG7YZ6KiCYfp1DWZbep6SHwVCfdRHFEbPd72kwGqi3n%2FhKEXDqv2Fa9WXikwF3EmxyF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83d9436139c1712a-OSL
alt-svc: h3=":443"; ma=86400

youareanidiot.cc/scripts/math.js

104.21.95.69

200 OK

1.2 kB

URL GET HTTP/3
youareanidiot.cc/scripts/math.js
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Requested by
https://youareanidiot.cc/lol.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type
ASCII text
Size
1.2 kB (1200 bytes)
Hash
91a6ca262b43459c5ffc7d26dd7ec517
65fc0670eb58bbc3697926813712b0edf4c57778
7a68a5e6ad9128312249540e6fff8a369b953fcf8cd668a64b357e659b37b817

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /scripts/math.js HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://youareanidiot.cc/lol.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 30 Dec 2023 09:30:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 1200
last-modified: Tue, 29 Aug 2023 23:32:20 GMT
etag: "64ee8004-4b0"
cache-control: public, max-age=31536000, no-transform, immutable
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3295030
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kgt7WZiLquLJ9W6boq%2FiXVRxmseF%2FdzCOUP1Uv1nVm45h9y3J243MHZTbQULeW4E%2BHiWHBOd2W0lBWzwX2U9HTdRpuSITOtNuPCBIPQ%2F9H7nNaH1Y0GDOdN1LFqAlB5TrqIw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83d9436139c6712a-OSL
alt-svc: h3=":443"; ma=86400

youareanidiot.cc/scripts/lol.js

104.21.95.69

200 OK

503 B

URL GET HTTP/3
youareanidiot.cc/scripts/lol.js
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Requested by
https://youareanidiot.cc/lol.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type
ASCII text
Size
503 B (503 bytes)
Hash
790c1b2b06aa85e813b9c203a15d1827
e56b220da7111f339db4f716ce23ffeb60c5c7bb
a64245f6e396f1f026efc23d0d8c454edaedf2c8074167945b92802eee05fce3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /scripts/lol.js HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://youareanidiot.cc/lol.html
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 30 Dec 2023 09:30:17 GMT
content-type: application/javascript; charset=utf-8
content-length: 503
last-modified: Tue, 29 Aug 2023 23:08:52 GMT
etag: "64ee7a84-1f7"
cache-control: public, max-age=31536000, no-transform, immutable
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3210248
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xYbbvdAL9j%2Fm447aZt5ewJvoaGu19QvKa7faRYCU6UQfXtDpSL3iJikN5DnQP8mm8JBaEFJRvce7g3RXCNPh5BKVC7hDNZ%2BNfg0u2SUXX7NfyeqNHQabUAzXitT7Ik3vrPdZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83d9436139ce712a-OSL
alt-svc: h3=":443"; ma=86400

youareanidiot.cc/media/youare.mp3

104.21.95.69

206 Partial Content

207 kB

URL GET HTTP/3
youareanidiot.cc/media/youare.mp3
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Requested by
https://youareanidiot.cc/lol.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 320 kbps, 44.1 kHz, Stereo
Size
207 kB (206997 bytes)
Hash
9901c48297a339c554e405b4fefe7407
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/youare.mp3 HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://youareanidiot.cc/lol.html
Sec-Fetch-Dest: audio
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 206 Partial Content
date: Sat, 30 Dec 2023 09:30:17 GMT
content-type: audio/mpeg
content-length: 206997
last-modified: Sun, 10 Apr 2022 11:47:14 GMT
etag: "6252c3c2-32895"
cache-control: public, max-age=31536000, no-transform, immutable
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2855773
content-range: bytes 0-206996/206997
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ppItIF867Xnc9ZyExPGyVZ5tXZz79fn8yCFrmNfQG%2BtjLPBNkVxLKZ6XOnKQzItRbAbkTPML4gtulvxH97%2FXrNIkqsgcqkuhl%2B3Wg%2FkZYPvkwTa9D0zZPIM0QMqIgm4vHJmv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83d94361cab6712a-OSL
alt-svc: h3=":443"; ma=86400

youareanidiot.cc/favicon.ico

104.21.95.69

200 OK

1.0 kB

URL GET HTTP/3
youareanidiot.cc/favicon.ico
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Requested by
https://youareanidiot.cc/lol.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 64x64 with PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
Size
1.0 kB (1037 bytes)
Hash
0b6dcf9c1429088c7f079d7cc291bb66
d23f9a17c55011a829c1365bcba999b27c4115f4
4b0358b16230208179720a09d205b99a3e9764e63815b09e9f1716a02fccadcb

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://youareanidiot.cc/lol.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 30 Dec 2023 09:30:17 GMT
content-type: image/x-icon
content-length: 1037
last-modified: Wed, 13 Sep 2023 06:37:01 GMT
etag: "6501588d-40d"
cache-control: public, max-age=31536000, no-transform, immutable
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3210251
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QKjN7BAaDmR8so9g%2FX%2BxM%2BrMBqe0Y%2FTfrOqSMndwGYOwrxEThUFfgEy5%2FhqCP85n9PnFMwjZbOiOsTgkI%2BGjPDZJObl%2BZMZ79FHmOT%2B%2FUc4lbDKo6%2Bhw6lv19HKLy9Zx9tlh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 83d943623b84712a-OSL
alt-svc: h3=":443"; ma=86400

youareanidiot.cc/lol.html

104.21.95.69

200 OK

57 kB

URL User Request GET HTTP/2
youareanidiot.cc/lol.html
IP
104.21.95.69:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint90:FD:B1:E2:D9:9B:BA:E4:82:67:15:C2:CF:3E:53:E7:AD:93:31:33
ValiditySun, 26 Feb 2023 00:00:00 GMT - Mon, 26 Feb 2024 23:59:59 GMT

File type

Size
57 kB (56681 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lol.html HTTP/1.1
Host: youareanidiot.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 30 Dec 2023 09:30:16 GMT
content-type: text/html; charset=utf-8
last-modified: Wed, 13 Sep 2023 08:15:02 GMT
cache-control: public, max-age=90, immutable
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09v7LEY8YGDU3jNbb4RzpliZmviLiCllR62sTZkS7D7LnDJLW16jvjTRkOdYVYa43WuYdY%2BFuMCxC4dM5N9PnrDOv%2FbFGkw%2Bu3e0YVitykUSb6mPuyXxrThKH0ldQ%2FLWX8qy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 83d9435e8d50b51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (6)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET HTTP/2

IP