WEBSITE ANALYSIS REPORT

http://btdb.theproxy.vip/

07 Feb 2026 · 10:46:56.000 UTCpublic

Report tags
Submit tags

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Hostnames

btdb.theproxy.vip10 captured requests
cdn.jsdelivr.net1 captured requests
cdn.show-creative1.com2 captured requests
cdn.show-sb.com1 captured requests
cdnjs.cloudflare.com2 captured requests
creative-sb1.com18 captured requests
exposuretigerphilip.com6 captured requests
flushpersist.com3 captured requests
fonts.googleapis.com1 captured requests
fonts.gstatic.com4 captured requests
formden.com1 captured requests
heartilyscales.com9 captured requests
matomo.hellohi.me1 captured requests
maxcdn.bootstrapcdn.com1 captured requests
msdoj.com2 captured requests
origunix.com1 captured requests
preferencenail.com4 captured requests
protrafficinspector.com4 captured requests
skinnycrawlinglax.com2 captured requests
use.fontawesome.com3 captured requests
vmuid.com2 captured requests
wayfarerorthodox.com12 captured requests
weirdopt.com1 captured requests

Connections

btdb.theproxy.vip → cdn.jsdelivr.netLoads from1 captured connections
btdb.theproxy.vip → cdn.show-creative1.comCalls2 captured connections
btdb.theproxy.vip → cdn.show-sb.comCalls1 captured connections
btdb.theproxy.vip → cdnjs.cloudflare.comLoads from2 captured connections
btdb.theproxy.vip → creative-sb1.comCalls9 captured connections
btdb.theproxy.vip → creative-sb1.comLoads from9 captured connections
btdb.theproxy.vip → exposuretigerphilip.comCalls1 captured connections
btdb.theproxy.vip → exposuretigerphilip.comLoads from5 captured connections
btdb.theproxy.vip → flushpersist.comLoads from3 captured connections
btdb.theproxy.vip → fonts.googleapis.comLoads from1 captured connections
btdb.theproxy.vip → fonts.gstatic.comLoads from4 captured connections
btdb.theproxy.vip → formden.comLoads from1 captured connections
btdb.theproxy.vip → heartilyscales.comCalls2 captured connections
btdb.theproxy.vip → heartilyscales.comLoads from7 captured connections
btdb.theproxy.vip → matomo.hellohi.meLoads from1 captured connections
btdb.theproxy.vip → maxcdn.bootstrapcdn.comLoads from1 captured connections
btdb.theproxy.vip → msdoj.comCalls1 captured connections
btdb.theproxy.vip → msdoj.comLoads from1 captured connections
btdb.theproxy.vip → origunix.comLoads from1 captured connections
btdb.theproxy.vip → preferencenail.comLoads from4 captured connections
btdb.theproxy.vip → protrafficinspector.comCalls4 captured connections
btdb.theproxy.vip → skinnycrawlinglax.comLoads from2 captured connections
btdb.theproxy.vip → use.fontawesome.comLoads from3 captured connections
btdb.theproxy.vip → vmuid.comCalls1 captured connections
btdb.theproxy.vip → vmuid.comLoads from1 captured connections
btdb.theproxy.vip → wayfarerorthodox.comLoads from12 captured connections
btdb.theproxy.vip → weirdopt.comLoads from1 captured connections
origunix.com → msdoj.comRedirects to1 captured connections

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

10:46:33.517 GET 200 document 16.5 KB 279 ms 2 alerts

10:46:33.913 GET 404 script 151 B 14 ms 2 alerts

10:46:33.915 GET 200 stylesheet 14.2 KB 214 ms 2 alerts

10:46:33.917 GET 200 stylesheet 30.8 KB 353 ms 2 alerts

10:46:33.918 GET 200 stylesheet 53.8 KB 218 ms —

10:46:33.920 GET 200 stylesheet 25.4 KB 56 ms —

10:46:33.923 GET 200 script 84.9 KB 92 ms —

10:46:33.924 GET 200 script 33.8 KB 93 ms —

10:46:33.925 GET 200 stylesheet 198.1 KB 335 ms —

10:46:33.926 GET 200 img 1.9 KB 164 ms 2 alerts

10:46:33.928 GET 200 script 9.0 KB 159 ms 2 alerts

10:46:33.929 GET 200 script 85.5 KB 883 ms 2 alerts

10:46:33.930 GET 200 script 85.5 KB 889 ms 2 alerts

10:46:33.931 GET 200 script 103.3 KB 499 ms —

10:46:33.932 GET 200 script 85.5 KB 495 ms —

10:46:33.935 GET 200 script 9.9 KB 165 ms —

10:46:33.939 GET 302 script 63.2 KB 154 ms —

10:46:34.110 GET 200 script 63.2 KB 372 ms —

10:46:34.473 GET 200 font 72.5 KB 188 ms —

10:46:34.480 GET 200 font 13.2 KB 189 ms —

10:46:34.483 GET 200 script 84.9 KB 21 ms —

10:46:34.613 GET 404 script 0 B 358 ms —

10:46:34.614 GET 200 script 83.4 KB 269 ms 3 alerts

10:46:34.616 GET 200 xhr 40 B 584 ms —

10:46:34.617 GET 200 script 83.4 KB 348 ms 3 alerts

10:46:34.617 GET 200 xhr 40 B 626 ms —

10:46:34.635 GET 200 img 0 B 783 ms 3 alerts

10:46:34.638 GET 200 script 6.3 KB 436 ms 3 alerts

10:46:34.640 GET 200 script 83.4 KB 184 ms 3 alerts

Transaction #45

Request / response

URL

GET HTTPS

https://preferencenail.com/sfp.js

IP / ASN

185.196.197.71

AS39572 · DataWeb Global Group B.V.

Requested by: https://btdb.theproxy.vip/

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
MIME type: application/javascript; charset=utf-8
First seen (UTC): 18 Nov 2025 · 17:36:30.149 UTC
Last seen (UTC): 03 Sep 2026 · 10:37:11.150 UTC
Times seen: 27836

Size: 83.4 KB (85379 bytes)
MD5: b3a5ba94d627e64a77c0e11eaffc96ed
SHA1: f7358693b31e44211dd98b5aa0dc2a3f423286aa
SHA256: 600f01dd96f043e58e0e70a82afbba6ffe0923d836f6293c1e6fc1cb5b074d34

Certificate information

Issuer: Let's Encrypt · R12
Subject: preferencenail.com
Protocol / cipher: TLSv1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SHA1 fingerprint: 0E:EE:1D:ED:80:5A:CA:0C:1E:93:89:94:78:B7:34:91:38:D4:89:51
Valid from: Sun, 28 Dec 2025 23:36:36 GMT
Valid until: Sat, 28 Mar 2026 23:36:35 GMT

Technology fingerprints

HSTS (Security)
Nginx:1.21.6 (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
Quad9 DNS Sinkholed	medium	Malicious
Hagezi Threat Feed Sinkholed	medium	Malicious
Cloudflare DNS Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /sfp.js HTTP/1.1
Host: preferencenail.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://btdb.theproxy.vip/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 07 Feb 2026 10:46:34 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 32181
Connection: keep-alive
Content-Encoding: gzip
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Vary: Accept-Encoding
Host: preferencenail.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
X-Request-ID: 24fc3cd1b19872d1870cca4c3d574f49
Cache-Control: no-cache, max-age=0, private, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

10:46:34.642 GET 200 xhr 40 B 284 ms —

10:46:34.648 GET 200 script 83.4 KB 158 ms 3 alerts

10:46:34.655 GET 200 xhr 40 B 266 ms —

10:46:34.662 POST 200 fetch 65 B 28 ms —

10:46:34.702 POST 200 beacon 2 B 34 ms —

10:46:34.729 GET 200 script 0 B 166 ms 3 alerts

10:46:34.730 GET 302 script 19.2 KB 5 ms 2 alerts

10:46:34.740 GET 200 script 19.2 KB 34 ms 2 alerts

10:46:35.067 POST 200 xhr 0 B 8 ms 2 alerts

10:46:35.163 GET 200 xhr 4.8 KB 105 ms 2 alerts

10:46:35.165 GET 200 xhr 4.9 KB 110 ms 2 alerts

10:46:35.166 GET 200 xhr 4.6 KB 108 ms —

10:46:35.284 GET 200 img 14.7 KB 109 ms 2 alerts

10:46:35.394 GET 200 img 0 B 96 ms 2 alerts

10:46:35.438 GET 200 xhr 1.5 KB 152 ms —

10:46:35.443 GET 200 img 0 B 128 ms 2 alerts

10:46:35.467 GET 200 xhr 1.4 KB 116 ms —

10:46:35.474 GET 200 img 0 B 94 ms —

10:46:35.478 GET 200 xhr 844 B 155 ms 1 alerts

10:46:35.746 GET 200 img 0 B 661 ms 3 alerts

10:46:35.753 GET 200 xhr 44.0 KB 604 ms 2 alerts

http://btdb.theproxy.vip/

Domain graph

Hostnames

Connections

Network requests

Transaction #45

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://btdb.theproxy.vip/

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #45

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://btdb.theproxy.vip/

Domain graph

Network requests