Report - redvelvet36.brennaunic.cloud/g9VNWbMRd5rYgpJnLnBvbG9AbGlzY29yLmNvbZNwb2xsb3MBAgMmczM9bXd6

Report Overview

Submitted URL
redvelvet36.brennaunic.cloud/g9VNWbMRd5rYgpJnLnBvbG9AbGlzY29yLmNvbZNwb2xsb3MBAgMmczM9bXd6
IP
172.67.146.240
ASN
#13335 CLOUDFLARENET
Submitted
2024-05-08 21:32:53
Access
public
Website Title
Your dreams become reality
Final URL
girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
svntrk.com	105291	2018-04-18	2018-04-27	2024-05-01	422 B	692 B	188.114.96.1
girlsnear4ycouf2.click	unknown	2023-12-22	2023-12-22	2024-03-17	3.8 kB	675 kB	104.21.45.121
pornhub.com	4903	2000-10-31	2012-05-22	2024-05-07	416 B	201 B	66.254.114.41
lh3.google.com	213	1997-09-15	2012-07-21	2024-05-08	430 B	840 B	142.250.74.110
o.pki.goog	unknown	2016-06-13	2024-04-24	2024-05-07	650 B	1.4 kB	142.250.74.131
www.xvideos.com	11464	1997-12-30	2012-05-21	2024-02-12	422 B	14 kB	185.88.181.2
accounts.google.com	81	1997-09-15	2016-03-20	2024-05-07	1.1 kB	3.7 kB	74.125.131.84
redvelvet36.brennaunic.cloud	unknown	unknown	No data	No data	523 B	7.5 kB	104.21.28.176

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed
2024-05-08	medium	girlsnear4ycouf2.click	Sinkholed

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	svntrk.com/assets/ser1_663bef6e0191c.js	0 B	2023-03-07	2024-05-20
Pretty URL svntrk.com/assets/ser1_663bef6e0191c.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 01:36:29 Times Seen37850372 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	girlsnear4ycouf2.click/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js	40 kB	2023-04-05	2024-05-19
Pretty URL girlsnear4ycouf2.click/scripts/fp.v3.646d4b3deea4287def3fdfc18906bcc7.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 13:38:28 Last Seen2024-05-19 21:11:55 Times Seen2861 Hash 1d8ad98fe3471d1a74d485f9b4737bfc a1190f7bb41660f682d59e15c2606279da0792f7 9aa12d141f3c41629c83ac95bf3bebab2b33bca7f8f8988bf64b53b57c73714c Loading...

	girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D	0 B	2023-03-07	2024-05-20
Pretty URL girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D IP 104.21.45.121 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 01:36:29 Times Seen37850372 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	girlsnear4ycouf2.click/landings/50/js/vendor.f8ad85bd679257f7baca823f7bbac294.js	103 kB	2023-05-05	2024-05-19
Pretty URL girlsnear4ycouf2.click/landings/50/js/vendor.f8ad85bd679257f7baca823f7bbac294.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-05 23:28:41 Last Seen2024-05-19 20:59:56 Times Seen237 Hash a7d8f9c893a35d600f60ff85606f211c 6cbaf746a3dd15218b67489dd419494fedf1102e e4bfe00cbde71eb0b3f89160adb365838d7267a417d9f575dcbabe8b839362ef Loading...

	girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D	0 B	2023-03-07	2024-05-20
Pretty URL girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D IP 104.21.45.121 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 01:36:29 Times Seen37850372 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D	0 B	2023-03-07	2024-05-20
Pretty URL girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D IP 104.21.45.121 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-20 01:36:29 Times Seen37850372 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (13)

URL IP Response Size

girlsnear4ycouf2.click/favicon.ico

104.21.45.121

0 B

URL
girlsnear4ycouf2.click/favicon.ico
IP
104.21.45.121:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Cookie: XSRF-TOKEN=eyJpdiI6IlVtQW5kTVZXQWJLVXVBdzJwM1dpenc9PSIsInZhbHVlIjoid3Jha1ljd09xb2NvQjNuQUlhSk91VGFGeG1MK2dGNEp3OU1uMnQ1eXZacU1yZTM4YTFwTW1kcWxVMHZ0QW1BWCIsIm1hYyI6ImE5MTc0MTBmYzc3MmUzMzcxYmI3NjZmZmY0YTUyYjQ1ZGIyNTQ2YmI5MWI5OTY2Mjg0ODQ3MmJiY2NiYzI4YzgifQ%3D%3D; laravel_session=eyJpdiI6IjVBSFdlYndiMEM0SmEraHQ0ai9LNnc9PSIsInZhbHVlIjoiUUpKaGp6YnoxWDFIVEpwdmppZWtIZy9memFrNlZEVDJzeXZib0JKSFhFN1EvSTlHUkdUU3BKVDBydmplRGJ3eiIsIm1hYyI6Ijg4N2M1NWEwNDZjODc5NjhhMzlkNWNiNTQ2NzI2YmM2NWVhYmMyN2E1YTM2ZGRjYzc2ZjAyZmEyZGExN2IwM2QifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:32:31 GMT
content-type: image/x-icon
content-length: 0
last-modified: Tue, 09 Apr 2024 11:05:59 GMT
etag: "66152117-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 1725
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NWc9YBXPr46EFpoYoTkTuV0DaJF8R8%2BIV6OHwZhUPHIu9S0HuiL%2FdWq%2B2pycO18bCjVRRJAt%2BFhvB5M6VO1Xil%2B4s%2FJ6iebAVLt9odlDzXO%2FkYgz2x72ns%2BrErVIbKfYY6S6gJIiNt83"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c9015df185688-OSL
alt-svc: h3=":443"; ma=86400

girlsnear4ycouf2.click/landings/50/images/9.png

104.21.45.121

200 OK

352 kB

URL GET HTTP/3
girlsnear4ycouf2.click/landings/50/images/9.png
IP
104.21.45.121:443
ASN
#13335 CLOUDFLARENET

Requested by
https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Certificate
IssuerGoogle Trust Services LLC
Subjectgirlsnear4ycouf2.click
FingerprintCB:6A:92:C0:B8:9A:1B:A6:FD:31:20:FA:BD:1E:82:42:7A:75:02:15
ValidityThu, 18 Apr 2024 10:46:50 GMT - Wed, 17 Jul 2024 10:46:49 GMT

File type
PNG image data, 1366 x 818, 8-bit colormap, non-interlaced
Size
352 kB (351641 bytes)
Hash
007de36e12524c6d08635bd8b8c06cb4
e883183d20c4334eb67ea71ef788942e893b8afd
57f07d3ce812445158155848e22d634a7728fbeac243324ddf4656389ad0f8ec

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/50/images/9.png HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/landings/50/fonts/vendor.9cfb45dd1bea24522c4ce870e4905fbe.css
Cookie: XSRF-TOKEN=eyJpdiI6IlVtQW5kTVZXQWJLVXVBdzJwM1dpenc9PSIsInZhbHVlIjoid3Jha1ljd09xb2NvQjNuQUlhSk91VGFGeG1MK2dGNEp3OU1uMnQ1eXZacU1yZTM4YTFwTW1kcWxVMHZ0QW1BWCIsIm1hYyI6ImE5MTc0MTBmYzc3MmUzMzcxYmI3NjZmZmY0YTUyYjQ1ZGIyNTQ2YmI5MWI5OTY2Mjg0ODQ3MmJiY2NiYzI4YzgifQ%3D%3D; laravel_session=eyJpdiI6IjVBSFdlYndiMEM0SmEraHQ0ai9LNnc9PSIsInZhbHVlIjoiUUpKaGp6YnoxWDFIVEpwdmppZWtIZy9memFrNlZEVDJzeXZib0JKSFhFN1EvSTlHUkdUU3BKVDBydmplRGJ3eiIsIm1hYyI6Ijg4N2M1NWEwNDZjODc5NjhhMzlkNWNiNTQ2NzI2YmM2NWVhYmMyN2E1YTM2ZGRjYzc2ZjAyZmEyZGExN2IwM2QifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:32:31 GMT
content-type: image/png
content-length: 351641
last-modified: Tue, 09 Apr 2024 11:06:22 GMT
etag: "6615212e-55d99"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u24O3MiPHWTjiJBKBgsU1SFIlivNRXPsU0U42lPeLoJu2w%2FLoyqseECS2l3hGLXt27nRgV3nleGxyYUOKJdPwL2B%2BRitlIPXw22dUYg6YxR5x9j639%2FWCJLxLi1IgoPWlTZoWkd%2F7kty"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c90161f565688-OSL
alt-svc: h3=":443"; ma=86400

girlsnear4ycouf2.click/landings/50/fonts/Lato/Lato-Regular.woff

104.21.45.121

309 kB

URL
girlsnear4ycouf2.click/landings/50/fonts/Lato/Lato-Regular.woff
IP
104.21.45.121:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format, TrueType, length 308680, version 0.0
Size
309 kB (308680 bytes)
Hash
cd6c6aac15595c65e75760bce456198a
43f6b15d9dedd33637cc5f34d80f7f2613bc28a6
7cf624c2cd85b4ac2c7b44b09627034156408931974cdbcec6df1223ea7a24e3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /landings/50/fonts/Lato/Lato-Regular.woff HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/landings/50/fonts/vendor.9cfb45dd1bea24522c4ce870e4905fbe.css
Cookie: XSRF-TOKEN=eyJpdiI6IlVtQW5kTVZXQWJLVXVBdzJwM1dpenc9PSIsInZhbHVlIjoid3Jha1ljd09xb2NvQjNuQUlhSk91VGFGeG1MK2dGNEp3OU1uMnQ1eXZacU1yZTM4YTFwTW1kcWxVMHZ0QW1BWCIsIm1hYyI6ImE5MTc0MTBmYzc3MmUzMzcxYmI3NjZmZmY0YTUyYjQ1ZGIyNTQ2YmI5MWI5OTY2Mjg0ODQ3MmJiY2NiYzI4YzgifQ%3D%3D; laravel_session=eyJpdiI6IjVBSFdlYndiMEM0SmEraHQ0ai9LNnc9PSIsInZhbHVlIjoiUUpKaGp6YnoxWDFIVEpwdmppZWtIZy9memFrNlZEVDJzeXZib0JKSFhFN1EvSTlHUkdUU3BKVDBydmplRGJ3eiIsIm1hYyI6Ijg4N2M1NWEwNDZjODc5NjhhMzlkNWNiNTQ2NzI2YmM2NWVhYmMyN2E1YTM2ZGRjYzc2ZjAyZmEyZGExN2IwM2QifQ%3D%3D; SRVNAME=w2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:32:31 GMT
content-type: application/font-woff
content-length: 308680
last-modified: Tue, 09 Apr 2024 11:06:22 GMT
etag: "6615212e-4b5c8"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sm8dK2QZQALqxQT3uouvEbQ1Ul2ZW4VGrIBh9Y3lQ%2Blb33VJWMUax8VpTV4pCn8vNFRIojL6v2yncffVqIgLPHUnxaLSo%2FxK%2BItGHw0Wd2WlkDVG%2Bo9AhCVhDctVKFjxnz3fxMhKORnQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c90161f5e5688-OSL
alt-svc: h3=":443"; ma=86400

pornhub.com/video/manage?o=mr&t=pr2

66.254.114.41

0 B

URL
pornhub.com/video/manage?o=mr&t=pr2
IP
66.254.114.41:0
ASN
#29789 REFLECTED

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /video/manage?o=mr&t=pr2 HTTP/1.1
Host: pornhub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
content-length: 0
location: https://www.pornhub.com/video/manage?o=mr&t=pr2
strict-transport-security: max-age=63072000; includeSubDomains; preload
X-Firefox-Spdy: h2

lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100

142.250.74.110

302 Found

337 B

URL GET HTTP/2
lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100
IP
142.250.74.110:443
ASN
#15169 GOOGLE

Requested by
https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Certificate
IssuerGoogle Trust Services LLC
Subject*.google.com
Fingerprint7C:B7:E1:97:03:6E:82:B6:52:F8:EC:C6:C6:50:D9:DD:80:47:E6:A0
ValidityTue, 16 Apr 2024 03:18:53 GMT - Tue, 09 Jul 2024 03:18:52 GMT

File type
HTML document, ASCII text, with CRLF, LF line terminators
Size
337 B (337 bytes)
Hash
66a43eafe19fd2e9782007272dd06ced
9d5112f8b4482ef224d10b0d0a17bfaf053e8e23
f432da756645f1aa0bdfff17c86556d7343c5ae482f941597552d9701560d6bb

HTTP Headers

GET /u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0=w100 HTTP/1.1
Host: lh3.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
location: https://accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en
cache-control: private
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 08 May 2024 21:32:32 GMT
server: fife
content-length: 337
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

o.pki.goog/wr2

142.250.74.131

471 B

URL
o.pki.goog/wr2
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f276d15245c6ec1add5b5814bb8444eb
975c127eec9cc6514f4092ed034df575bcdeacd7
a77526d25e2226cff93318a2e87ab8d03eac1796e44fd997c5428693ddb61bd0

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 May 2024 21:32:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.xvideos.com/favorite/90902157/mk_1123

185.88.181.2

12 kB

URL
www.xvideos.com/favorite/90902157/mk_1123
IP
185.88.181.2:0
ASN
#46652 SERVERSTACK-ASN

File type
HTML document, ASCII text, with very long lines (10366)
Size
12 kB (12253 bytes)
Hash
ab898e6b550a16ad37eaa19729249090
fa3517a0a9b5d384c2881210a4494118611a30b0
7c95a2930e50cfef4ab74df45ff7ee21d251eaf968995931fe855be2633d1b18

HTTP Headers

GET /favorite/90902157/mk_1123 HTTP/1.1
Host: www.xvideos.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 21:32:32 GMT
P3p: policyref="/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Accept-Ch: Viewport-Width, Width, Device-Memory, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Bitness
Vary: Accept-Encoding,User-Agent,Accept-Language,Cookie
X-Frame-Options: SAMEORIGIN
Report-To: {"group": "csp-endpoint", "max_age": 10886400, "endpoints": [ { "url": "https://www.xvideos.com/csp-reports" } ] }
Content-Security-Policy: default-src 'self' data: 'unsafe-inline' 'unsafe-eval' blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com 1868565294.rsc.cdn77.org static.cloudflareinsights.com www.google.com www.gstatic.com fonts.gstatic.com fonts.googleapis.com ajax.googleapis.com fcm.googleapis.com accounts.google.com *.cdn77.org  *.nk-img.com  *.segpay.com  *.online-metrix.net *.vscdns.com *.vsmvideo.com www.tjk-njk.com *.orbsrv.com *.opoxv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.tf4srv.com *.aacdn.net *.adglare.net www.flirt4free.com www.ohmybutt.com www.secretpartners.com *.asf4f.us *.livejasmin.com *.jsmcrptjmp.com *.awemwh.com etahub.com ctrack.trafficjunky.net tracking.sexcash.com *.gtflixtv.com wss://*.1ka.com https://*.1ka.com https://media.1ka.com https://u.1ka.com https://n.1ka.com;img-src 'self' 'unsafe-inline' data: blob: *.xvideos.com *.xnxx.com *.red-cdn.com *.gold-cdn.com *.xvideos-cdn.com *.xnxx-cdn.com *.others-cdn.com *.cdn77.org www.google.com www.google-analytics.com ssl.gstatic.com *.nk-img.com *.camster.com data-cdn.pornbiz.com *.vscdns.com *.vsmvideo.com *.doubleclick.net *.google.fr *.google.com *.segpay.com *.online-metrix.net cdn.asf4f.us *.gtflixtv.com *.1ka.com *.orbsrv.com *.exdynsrv.com *.afcdn.net *.aucdn.net *.justservingfiles.net *.tf4srv.com *.aacdn.net *.rtbsuperhub.com; report-uri https://www.xvideos.com/csp-reports; report-to csp-endpoint
Referrer-Policy: no-referrer-when-downgrade
X-Robots-Tag: noindex
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: nginx

accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQzBW9TlMA0qWe9rVDktA7F1Z3aUujJTqGX7S6_52JWnclf9qWkteOCAEI62m1MnKWg5m1CWeA

74.125.131.84

302 Found

441 B

URL GET HTTP/2
accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQzBW9TlMA0qWe9rVDktA7F1Z3aUujJTqGX7S6_52JWnclf9qWkteOCAEI62m1MnKWg5m1CWeA
IP
74.125.131.84:443
ASN
#15169 GOOGLE

Requested by
https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Certificate
IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint75:65:5E:EB:A9:59:16:DF:32:A3:39:DC:8A:A2:FD:28:92:33:6B:0D
ValidityTue, 16 Apr 2024 04:20:43 GMT - Tue, 09 Jul 2024 04:20:42 GMT

File type
HTML document, ASCII text, with very long lines (408)
Size
441 B (441 bytes)
Hash
a1f5f50585162ad9a681004ed7e65d3f
564df2c9b6dfeab5048a5206f57d58076a25f031
99fca4e327b706014155487917176821f3f7453f186baf4365d9550f65efb1de

HTTP Headers

GET /InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQzBW9TlMA0qWe9rVDktA7F1Z3aUujJTqGX7S6_52JWnclf9qWkteOCAEI62m1MnKWg5m1CWeA HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:6BSOC8-vSOVWQn7hifSzwGJoH9AMBw:4wRLYgaeF5KnvEsP;Path=/;Expires=Fri, 08-May-2026 21:32:33 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 08 May 2024 21:32:33 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Flh3.google.com%2Fu%2F0%2Fd%2F1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQxtYm4_kKqsD6d76OMzjXU3C6ClxOTQCUc2OvCd4s_Zg0ErqsGDcqLO71XAeUDUdQE9IPGe&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1811160160%3A1715203953045205&theme=mn&ddm=0
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-c8Z5HcNnXCLNcFclBDH3IA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 441
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

o.pki.goog/wr2

142.250.74.131

471 B

URL
o.pki.goog/wr2
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
295c1ab534489dc31c4940823ae306a6
f64846d666665600e9b3191323707b0312ea2103
f71d58c2003e0da135fb8f57ef576b17eebe7916ced184c7bf99f603049eaddb

HTTP Headers

POST /wr2 HTTP/1.1
Host: o.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 08 May 2024 21:32:33 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

redvelvet36.brennaunic.cloud/favicon.ico

104.21.28.176

6.8 kB

URL
redvelvet36.brennaunic.cloud/favicon.ico
IP
104.21.28.176:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text
Size
6.8 kB (6795 bytes)
Hash
a1db41220ca1b5a02e5b679c0416fec6
ad9d48fe82cb8a90fbe12408c96ebeb4bed2cb4f
c03ea244efb0c1da461d18dc3ac5b93f2140bb947f2bba019465961cb3dac1bd

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: redvelvet36.brennaunic.cloud
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://redvelvet36.brennaunic.cloud/g9VNWbMRd5rYgpJnLnBvbG9AbGlzY29yLmNvbZNwb2xsb3MBAgMmczM9bXd6
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 21:32:28 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/5.4.16
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Wed, 08 May 2024 21:32:28 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n09tEzVlaGl1wUMqRi3GVSo%2B507HF2jqc9ch3SnVQjB0FK5tJMvzmvAbL9OXcrVhUQd3DbDGbAYfZZn8tel%2F9XBN4BRR9L3KkVfZYYEbUqpdbZbi45d%2BFYIyTf4Q0JJ%2Btw45fL6gqSqMMhmnoJUh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c9005bd81b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D

104.21.45.121

11 kB

URL
girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
IP
104.21.45.121:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text
Size
11 kB (11249 bytes)
Hash
c210baf5d4e2bf808085415427ab799d
f12a72ff5c8d82598a4208844814c0acce2f40d4
fe6c6c12f805d012a1e7fe55221e81b1ee9bb410422e04b67387c602a6b656b1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D HTTP/1.1
Host: girlsnear4ycouf2.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://redvelvet36.brennaunic.cloud/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 08 May 2024 21:32:30 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6IlVtQW5kTVZXQWJLVXVBdzJwM1dpenc9PSIsInZhbHVlIjoid3Jha1ljd09xb2NvQjNuQUlhSk91VGFGeG1MK2dGNEp3OU1uMnQ1eXZacU1yZTM4YTFwTW1kcWxVMHZ0QW1BWCIsIm1hYyI6ImE5MTc0MTBmYzc3MmUzMzcxYmI3NjZmZmY0YTUyYjQ1ZGIyNTQ2YmI5MWI5OTY2Mjg0ODQ3MmJiY2NiYzI4YzgifQ%3D%3D; expires=Wed, 08-May-2024 23:32:30 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IjVBSFdlYndiMEM0SmEraHQ0ai9LNnc9PSIsInZhbHVlIjoiUUpKaGp6YnoxWDFIVEpwdmppZWtIZy9memFrNlZEVDJzeXZib0JKSFhFN1EvSTlHUkdUU3BKVDBydmplRGJ3eiIsIm1hYyI6Ijg4N2M1NWEwNDZjODc5NjhhMzlkNWNiNTQ2NzI2YmM2NWVhYmMyN2E1YTM2ZGRjYzc2ZjAyZmEyZGExN2IwM2QifQ%3D%3D; expires=Wed, 08-May-2024 23:32:30 GMT; Max-Age=7200; path=/; httponly; samesite=lax
SRVNAME=w2; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P9A4gd8qDXdQEfu7kDEi3o7QTtQPGmzwj5xz%2BYOGjzuQAEQblv0msMYUL1UVm3GcqLB4KNQtJHB%2B2E%2Bbq%2FPQFsht3paVY5Px1cNPML%2BlFcJH31z%2BYyECNmRFKU9P8ftXr%2BhOg2b13oqQ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880c900d386d1c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

svntrk.com/assets/ser1_663bef6e0191c.js

188.114.96.1

200 OK

0 B

URL GET HTTP/2
svntrk.com/assets/ser1_663bef6e0191c.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Certificate
IssuerCloudflare, Inc.
Subjectsvntrk.com
Fingerprint83:5F:B1:05:69:64:18:2B:AF:21:B6:08:6A:BF:B6:F1:B5:95:C8:99
ValidityThu, 28 Dec 2023 00:00:00 GMT - Fri, 27 Dec 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /assets/ser1_663bef6e0191c.js HTTP/1.1
Host: svntrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://girlsnear4ycouf2.click/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 08 May 2024 21:32:30 GMT
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: BYPASS
set-cookie: svnimp=663bef6e77a54; path=/; secure; httponly; samesite=none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1hiUOn4SgupMSYIXpD8saJi25RbvObRRa5qoyDgTAU%2FqHeHCDde5QIGoYsyd7VAN7QqDJcusNKgxNJXvzPd%2Bfdtim0DZZB6NrAlKAWGhVOjsLVY7LFpJLejRbpAt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880c9011490756c5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en

74.125.131.84

302 Found

0 B

URL GET HTTP/2
accounts.google.com/ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en
IP
74.125.131.84:443
ASN
#15169 GOOGLE

Requested by
https://girlsnear4ycouf2.click/?s1=ser1&i_CFBIU=Zy5wb2xvQGxpc2Nvci5jb20%3D
Certificate
IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint75:65:5E:EB:A9:59:16:DF:32:A3:39:DC:8A:A2:FD:28:92:33:6B:0D
ValidityTue, 16 Apr 2024 04:20:43 GMT - Tue, 09 Jul 2024 04:20:42 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /ServiceLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:gF7X72pmtnX38u2qo-4sszCUiKanaA:ocVGKmIfSVe6PJDs; Expires=Fri, 08-May-2026 21:32:32 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 08 May 2024 21:32:32 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://lh3.google.com/u/0/d/1l0frEmdXyaOzgdSdyzEFLxHRz8nZsme1xNv0ZMbsDI0%3Dw100&hl=en&ifkv=AaSxoQzBW9TlMA0qWe9rVDktA7F1Z3aUujJTqGX7S6_52JWnclf9qWkteOCAEI62m1MnKWg5m1CWeA
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-n9714cjj99bUQWiBbGWs8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN