| boredimperissvieos.shop/apimdP |  104.21.72.135 | 403 Forbidden | 5.8 kB |
URL User Request GET HTTP/1.1boredimperissvieos.shop/apimdP IP104.21.72.135:80
File typeHTML document, ASCII text, with very long lines (14176), with no line terminators Hashdfa778cbcd20c8035d14012412ec73dc 8f5c0a79bd8a710e06889647a921e29f52f6d23c f0f71e13f3223f45a8b35a0b6bf3bd3228d226f72596121d5e6062b05c62891a
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /apimdP HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 23:38:51 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: cidaRyxU4AtvVIT6S7Qhl9E7PJQJWbvMXb6G051US1G6gDg3tSB29nsCQUZDEDmgXUCXZyzMZah6hEoGzeBjTZxa9aCngTqzckkpEXUDxNz3qOqq4hDjNN0zx969uNraMtgMzjtYNhooCfe7mQThdA==$7LKhFUuP5MoJo74uF2SDVw==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7WJ%2BncFIznfc5O90ioe8wLyBlw1N%2B%2BLHWMtXwI4l1phWtN85whhZTJYOnlH4%2Bpszxq3YwGH5%2FTM305yrDpwVwghhw1iMaUjhMgar%2Fy%2B873CL7dX5bx3sPudZTgibjiDfkgj6Cxo%2FOpvGAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880d49292a10b4fd-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d49292a10b4fd |  172.67.186.30 | | 113 kB |
URL boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d49292a10b4fd IP172.67.186.30:0
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size113 kB (113018 bytes) Hashe3f4618e0767baf6e4988888022ccdb0 bfe76b4b70d76a09bd2c9eb12973e2521fa4fdb4 8792fc62357d67e37204f877b4a88c5918c4f11ce5149a0ed67e4b8b9aa91e73
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d49292a10b4fd HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP?__cf_chl_rt_tk=6paUzOs_e4QyNjFjdCnmM9HhJqR1Mp6aGdc4s6dNa6w-1715211531-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:38:52 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N06P7UvYhjZPqIh5ZKOKUS0IqhzwFE5VNoIlZyv10dof%2FQP9EwZRUjpuntbLg%2BoOD51mANSFDXQC5kYM4PVIQqVn1Xh6fS7Uh4zqELqABxWyLBjKnI0h72XQOofmAvTZx%2FVj484UYOIrYw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d492aff56568a-OSL
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/favicon.ico | 172.67.186.30 | 403 Forbidden | 5.9 kB |
URL GET HTTP/1.1boredimperissvieos.shop/favicon.ico IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeHTML document, ASCII text, with very long lines (14259), with no line terminators Hash5d4de179eccfab7f4c8a110e25b33c82 8c6562436101409d30e05f56f87555c4a957506e 52eafcdf817d8708febbdc74f7be0c03678e62e029db0e4d60fce1d7f7652483
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP?__cf_chl_rt_tk=6paUzOs_e4QyNjFjdCnmM9HhJqR1Mp6aGdc4s6dNa6w-1715211531-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 23:38:52 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: LLDHbjsS2L+dmfYcSxVB0fu+J8X0OhOdIFTSIhA0OBKw4Jnkb8HUvmgcnbd0UgZX5vS+b2YgYe9XzpcBW4XZn3nq1W5m6n4z/EJQ8F80p3qqMdVgnBHxStyJAXURkMw8UQ2Bsf3ahINBqZzy2jAYuw==$csucxy/Q7ebPJE9AHjDdRg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hW0Qm%2BYV7xcgd3LXgkW6BGizOmnbse2gS1XnQyEmCQCegE5AjzNEIY6IcQcZOLLZAW6W6s9nY9X5JWhVGOrY5b2Uh2qfVxmwB3fUr7Y4Oi40dMSxkUjaLvMat3CMUJIosA0YYtXIlG%2FHyA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880d492b4f75568a-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/favicon.ico | 172.67.186.30 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1boredimperissvieos.shop/favicon.ico IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeHTML document, ASCII text, with very long lines (14173), with no line terminators Hash5d61cb3fa474c82cdf6ccfc8bfb4df55 c0b8dc8a7f930598db0c31ac526eb72eeec2782a 57acd2992467716d69ef29866f4cc220b91a21e8028d60ecdba00ef6a03715ef
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 23:38:52 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: DDcjNPWfJEiuAMwkAJJbaYgL7zdXq5EjPks/q4nNQ6UAp1xgJQ7MqgFaPRKVtz7ZJmbQUpXMCxrcWFk3ZLu5Q1Wkm7I9/RfIQ4KEFApu/LFzHk2mJKZmj1hzhTdTRIiqK8fDcPDfm0o3K8i4MT/DyA==$aQbVI6wq6FD5oUthmmj7+A==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=58cj9WiL11G7ROV%2BB9Cgq6A5sMsLFGztWDQAtYwtEZrYfumRv29XveW2z9ESwCs3s4Dg%2F%2BwC09NUbEhDTEi3GGBBn%2F29LilYdIFnvsuhhogMp%2B%2FA3VC1fd6YlV7eG%2FAGGYLIkRv7Ieeq1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880d492bcd36b505-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 | 172.67.186.30 | | 12 kB |
URL boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 IP172.67.186.30:0
File typeASCII text, with very long lines (16368), with no line terminators Hash61d07bcce77020b529b2863ea01a2a7d be0111cee61b367d7fbcc3cfbdcb90ab01b54f2b ecdc9f1b39ca6759cdee91e0f89c020ea2c990e7c595e2b20157255bc486d7ac
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
Content-type: application/x-www-form-urlencoded
CF-Challenge: 37ba116fdaf6452
Content-Length: 1873
Origin: http://boredimperissvieos.shop
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:38:52 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: bQJoaf3rKxLu5mAwmStYkwXi1U2mD9h1O7exrzrQNzWWhIV7B3QyOzQo9uDQEkFO$JWlATwJ3wkMW02NWVcptLQ==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9y326YD31bLK8EpGPVweIylzIpZy4YuI4d7UFfimzsQYS1NBCZwjMuTehV3wPgnrIi0elgGmDRjarLsvkqEzJzjnGQDBNEjWQ9dPxqyoqPWxr1dTzRMTYG0QO3T6JkEf%2BOKYCr%2BBPxuJcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d492c8bdf5689-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal | 104.17.2.184 | | 110 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal IP104.17.2.184:0
File typeHTML document, ASCII text, with very long lines (41702) Size110 kB (109919 bytes) Hash6a822899e10d94a19ceee40383db72af f6b233e1c345946397ebae7cecc9e966b7f8849f 1fa1cb7492b939e5e2a1c5dde4c0843517e8060209aeca40c837c43678c44929
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:38:52 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cross-origin-opener-policy: same-origin
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
vary: accept-encoding
server: cloudflare
cf-ray: 880d492dca4fb51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.2.184 | 200 OK | 61 B |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:38:52 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 880d492ebacdb51d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d492dca4fb51d/1715211532933/oAQQK_AhqBmk9qA | 104.17.2.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d492dca4fb51d/1715211532933/oAQQK_AhqBmk9qA IP104.17.2.184:0
File typePNG image data, 8 x 3, 8-bit/color RGB, non-interlaced Hashea2ae369581541e260b4df3743e4f6f6 723fa6fd8fc7a8154ca65125730b1f33809dffc4 99e2bb69b3865388348720d5bdbf3bfb1a3651eb72f6dcf9506584b0ce166a3f
GET /cdn-cgi/challenge-platform/h/b/i/880d492dca4fb51d/1715211532933/oAQQK_AhqBmk9qA HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:38:55 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 880d493f1886b51d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 | 172.67.186.30 | | 1.8 kB |
URL boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 IP172.67.186.30:0
File typeASCII text, with very long lines (2328), with no line terminators Hash7f3c8a483ea5699c6b6fdd5600a23d6a 8c1c4ce15293f7997627e2c16fd3b5d1e7ff39b5 b7a7a246d3da06228112cb90ce3dc56b97510b1484f742c5659d245477f3c014
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1015740028:1715207439:8FkkzOlFm74ynO9IPFVZZ9veQP2KQPfQsdq_CdkbcUI/880d49292a10b4fd/37ba116fdaf6452 HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
Content-type: application/x-www-form-urlencoded
CF-Challenge: 37ba116fdaf6452
Content-Length: 2535
Origin: http://boredimperissvieos.shop
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:39:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out-s: CAMuezkByYJ3IcTjrS6gOA==$r1RhtTRu1/LOsHjZAAlhXw==
cf-chl-out: uXEyX2cskNXCbnUCK2mpUq2J08iIdMCAL16Vr8f6rZjV4ygfj67206litAt9yNRMbMaSlGlh0dx8zgG5C2HWYfktsoyXLjH5VKzPzhETjww=$28Ylc9AV7hsyIVHinC/RzA==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m75RepNX13whTzQq%2Bj8sUwMmC%2BzHFYW1pUmcAaebvE9aFB64kwhPL3qq%2FrRWsPR9D8dmbchNKAenp%2BSdw%2BC5GAOJDkxBv4oEUlwU7GMJ9nFFCEAKbwCjRNubu9v6DN%2Bgv1Xp6TIKr5BwUw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d496dfdd25689-OSL
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/apimdP | 172.67.186.30 | 403 Forbidden | 5.8 kB |
URL User Request GET HTTP/1.1boredimperissvieos.shop/apimdP IP172.67.186.30:80
File typeHTML document, ASCII text, with very long lines (14197), with no line terminators Hashb333908c18c65cbdc7f4732c1b57c512 3225773fb2a22ed9fbd75798c67c83158751424b 34c8960c64129a1842c819e56ddf783e346e8764f39ffaf834c2f9dc0950aaeb
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /apimdP HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 23:39:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: ocK9kbRZrf1/mZgXUykwtxcHm+ybgVzRiz2CmhDh60ulGH2cXp8y03yoxQPgOq/rRtUwd2bx8aN0IGkEDNwTD1MZEG9JposW1h5pdkDgfe35h1okVbMPBSwP1WzumJq1QIfl3mriDRqrZGTC/j5rgA==$RqqrARhTkEUCdKjNXXPBnQ==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kvIJfPfKqk518Tvk0gAx2b1tgqmXDJJ8svkD6jkhjySZ7Hai3FIdEl%2Bn%2FV4wf3eL0CeyUUVk1woEgnsWT7VVzhnHtIZ4nCU3UTqHBG16qq%2F7S3zzRwnO%2FFCIIvotOil19rawtBxhcB9qDg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880d497ade275689-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit | 104.17.2.184 | 200 OK | 126 kB |
URL GET HTTP/3challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit IP104.17.2.184:443
Requested byhttp://boredimperissvieos.shop/apimdP CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (42565) Size126 kB (126324 bytes) Hasha5b92920e25651d2058f4982a108347b caeeadd68d38fdb681c52006c68880abc2e8a1a6 49a5abedf03eb8ad9a66eca7c5ccb8e59a440e06958e1e7b71d078f494178dc5
GET /turnstile/v0/b/ce7818f50e39/api.js?onload=Ialy2&render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://boredimperissvieos.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 May 2024 23:38:52 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=604800, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 880d492bdac95695-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d | 104.17.2.184 | | 6.8 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d IP104.17.2.184:0
File typeASCII text, with very long lines (960), with no line terminators Hasha77e35ae73122ebae21252b986d6cd8d 569ebb53be739b33f55c5e6af428888191ed0c39 14d40970546fcced4446802fce605ebd1fc5aea6b7493878a7f33909e3cf55f7
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 0afe2d8dbc31e9d
Content-Length: 40540
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:02 GMT
content-type: text/html; charset=UTF-8
cf-chl-out-s: +J6v/99eeNHXB6W8xaEUzw==$ZG2eLkH/iKUMFQZfk/J3Tg==
cf-chl-out: LSagtla29Pn+KOvaEp7O4tv4EmbE71xeiXSn+SnZlqUvVHMsxNTmFw+BatjUHPikv8rGPnA4kOiWLNdYb4JuYk69pMr8/bU9iuf/M3eEiY0=$Hr7Y2OjFkCi3AIBnWzJ5vg==
vary: accept-encoding
server: cloudflare
cf-ray: 880d496d6d0ab51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| boredimperissvieos.shop/favicon.ico | 172.67.186.30 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1boredimperissvieos.shop/favicon.ico IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeHTML document, ASCII text, with very long lines (14195), with no line terminators Hashd3be2d524e6643e96b378e9b299651fd 4479f019e90fe2794da92860ad2d10e580204414 000b2f8fae7b304260b930465f779494a65317028d19d4e6e65c049dcc64cacc
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Wed, 08 May 2024 23:39:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 4Ggd3XU1otrnT43ee9xOlKmca9oKh2ApRbRk89YZ5E+P0ANm7Fbe2KLvRhv38GihgrSKyXXyqdPuYcsWM3Z1j52gxf6CR+yhmEfVhJot+OI6wm7aso0xVowx26IenfjU3CgE1E3dvAjSnWVwann7eA==$Xd8mRdMynEhHS9VK0H1rGQ==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KPGGgxQF10TlPBy8tYh0rSPfEdWcri5D%2BQdNAsOlSigeQbc671%2B%2B%2FfGYbxPdLuwZ0%2Bcd2LJlD7q1%2BysSMaj6rmJLNXg1yLPy2NXijBfeqvJZfMOVc%2FJUZxetfDOMFE24dZBmc2y1VwcYRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880d497c09400b4d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 | 172.67.186.30 | 200 OK | 12 kB |
URL POST HTTP/1.1boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeASCII text, with very long lines (16376), with no line terminators Hashd2adc717deb23e3510e0ae240f4e5691 282ac12bc151a16eb18b89545509d97fcc3b3187 c3a93c80842a222d3af15738073a48a2d986b1b76de0e2d24458ce5c743fbac9
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
Content-type: application/x-www-form-urlencoded
CF-Challenge: 859afa62c522537
Content-Length: 1879
Origin: http://boredimperissvieos.shop
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:39:05 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: vIQSIzrj8189X2VrJskHriR6fEknwIeT044AgGk+NPZIFcshaM45ii4tAsA6qPwH$eLfPp3BtjyPTS2o+1xwBBg==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A21TLYMxEspsAwdQ2TYDYwL2EIbWUW%2BaL%2BDdZ8pthy%2F2FdMSG6TtA7NWbTuRibEa6SU6dFWCZdiDEXPYPyqcqCXeP7MZfxyXQTQoax2cM6eN7YGl4wmVYJZr4yTXjKWpEuyTmkbTOxSXfg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d497ce85556bd-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d | 104.17.2.184 | | 21 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d IP104.17.2.184:0
File typeASCII text, with very long lines (22252), with no line terminators Hash76d352e27c588eadce4b1f0f0360862a ae1f06e1b0f27bdec67218065ef0890bf493cba8 2baa49f5769b38623b5b2104dde29f1b8b3f292b9ffb56a14d4d687c9c213324
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/998827719:1715207333:Cv7tdGolYClrq-YUcEowQpZosphub8ZlAS6v8A84PjE/880d492dca4fb51d/0afe2d8dbc31e9d HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/se9ds/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 0afe2d8dbc31e9d
Content-Length: 27653
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:38:56 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: bB3QGGTi36FeaEyJxQQulDfvuCZCNAEzTOPoqdWYorjR064PopLUSJHk7Y/VRWPv$foNWJY2iW37ZHPQt6fwX2g==
vary: accept-encoding
server: cloudflare
cf-ray: 880d4944fdeeb51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d497dec47b51d/1715211545744/AWUZvdcEF4X4d-7 | 104.17.2.184 | 200 OK | 61 B |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d497dec47b51d/1715211545744/AWUZvdcEF4X4d-7 IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typePNG image data, 73 x 52, 8-bit/color RGB, non-interlaced Hash8ff92d14e2c5c4a8b3dcc79dd14bdccc 752fab43d8696533372bddf2d5b8a6e36b65b597 14d803b92e43a95d61d0df8e2655ae0966f2ae871788990d84ecdf46e9da5602
GET /cdn-cgi/challenge-platform/h/b/i/880d497dec47b51d/1715211545744/AWUZvdcEF4X4d-7 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:08 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 880d4991fa62b51d-OSL
alt-svc: h3=":443"; ma=86400
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 | 172.67.186.30 | 200 OK | 1.8 kB |
URL POST HTTP/1.1boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeASCII text, with very long lines (2328), with no line terminators Hash662f49ce159d5aafc8d7242a344a7e78 cfc1c2583b9918e031e9556e78beb55922d59457 c0ca57b25d5d593986707cd66c5004aa17961f68270574f11cfed51f37e44ff3
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/205921390:1715207365:RIkfQ44UQhdKcnqz7_lbC1EyBZtKnBmLT_p0nugsWHE/880d497ade275689/859afa62c522537 HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP
Content-type: application/x-www-form-urlencoded
CF-Challenge: 859afa62c522537
Content-Length: 2540
Origin: http://boredimperissvieos.shop
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:39:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out-s: ERl03LkSje/g/0A7h64+PQ==$o7ywShQojDIMhTeMHn1alg==
cf-chl-out: A/5wGW7y1LcyFhj6wUbaPB7SC+9ApvmnNMjZ/7Kcx8ZTrEHXt3QbPuWD31oBY/NSy41PmAii8sum1rovD6fUBhJqI9LOMOT92ugTs/ro6F4=$Rlrd/eF9jqG102UzKQ6/ZA==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vEdAybZntXQZtIrbkyR7icCDdSkE0yCiRhGBsFGK3WW6WrdOHmGcmx73c9FEAWGGbJYKts4W%2BbS95MsLvfu2iMuT8s2r8jZbq8TNQOKKjeZzsSo6iCibl1h68QFNUJf%2FyasKe0vGQOYjlw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d49b56c8956bd-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d497dec47b51d | 104.17.2.184 | 200 OK | 430 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d497dec47b51d IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size430 kB (429983 bytes) Hashcdf200b4db152d56fd67613f2acaa79d 42ce3586ae8cd302b166693073334dd8dbba7964 23354620cc41f88a316fe749b074fecbb5eb15618225b125cc6877c2ca862129
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d497dec47b51d HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:05 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
server: cloudflare
cf-ray: 880d497ebcbdb51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 | 104.17.2.184 | 200 OK | 22 kB |
URL POST HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (22280), with no line terminators Hashc6662df81dbfab45b13b8f9e3803f599 103cf3a07c239f9e62199b9fc52a93a5b7576c3e c7fce409ec14903ee65dd16aef890cd3dd6e2008c8056f026ee49bd39892419a
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: ef90bc035695849
Content-Length: 28278
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:08 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: gWzMM8sw/OgTo/MDD19jXQ69CWMk7B/jMbHwBfhJ798qIP+DbtNjGdzTiYTtKh5Y$7WGkVBhicMi1TJYNDMvtuQ==
vary: accept-encoding
server: cloudflare
cf-ray: 880d49939b9fb51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 | 104.17.2.184 | 200 OK | 118 kB |
URL POST HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size118 kB (117484 bytes) Hash21e912d907d6b0a63302248a88783c6d 3468f5a3806a912a23d89dbfa7d48ab20df626fc a68a8c3ee852efa614e3a0c8dc5f9c7ea9484a66148c84b0340ab64f6f296ac1
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1109473759:1715207398:sSwdEz2x6TAVw3hUicYRUjRPl7ZjrZBjpPuVfO3S-ao/880d497dec47b51d/ef90bc035695849 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: ef90bc035695849
Content-Length: 3531
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:05 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: bpFH7f0UMuskoLlAI2vm5AacHCSH4yKBIJY8da4JWNn6N6wfnksPxB89bf8E1D9pj8NCWRYa8B5HFoiEyLp7XKndijzFwwRXcyV4nhe6sOWQ6U3LnsudW0HdkIFHS/0wmlKEMG1arTCtxecVPqkRtYZ88rV3KD8i8SUJ1nHeBf4a523pE1H9RoHvxbcNFzG6D5VOErNNmt1BFtEmGTV2ABfNznFGqrURka8Clu07hUYgrbZ2ymYtLDUdMOZ+vlZHmmiqFu0ZhwS7/QORsu+Kfjk1UOQGDQKhuifOhgOdudUdN+U2PHANnVUa9QooHIauxjPPtW6CuiEXqBPPh1ly3WhC56erdOgT14mNUrHTbhUkqlejNncO7R35FIFLH5z0wbOI7lfmc8c3aMJbDS/rPEuvgQUxm7nga+YVwpyijnyPC5Wq24AC65KyVnBuz8GTiHgMGOLTzqrQLN4qHs3xFQ==$hqRdFfqkLq0PIOHK6OtpzA==
vary: accept-encoding
server: cloudflare
cf-ray: 880d4980be12b51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d497ade275689 | 172.67.186.30 | 200 OK | 393 kB |
URL GET HTTP/1.1boredimperissvieos.shop/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d497ade275689 IP172.67.186.30:80
Requested byhttp://boredimperissvieos.shop/apimdP
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size393 kB (393131 bytes) Hash85f340688aa306057ae9b4cf71c59561 3d2dabc97129a4a52750ca89e1113608a6363662 2d93e47f3ef59637bb810005e39eca26104fb5fb6322c7c82b48fd9e1d1fe0da
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=880d497ade275689 HTTP/1.1
Host: boredimperissvieos.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://boredimperissvieos.shop/apimdP?__cf_chl_rt_tk=BGaJYR_bSmAEIGQrWmWY6Q5XNNirpwxMoqE0VvgGJfs-1715211544-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Cookie: cf_chl_rc_i=1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 08 May 2024 23:39:04 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bZxD4accAx6e%2B%2Ff55yZW2FpMj3OilxTrY0etl8bX7z6UHxmZTPzdHj0v830yLhG58y%2BRPyJTZZHQ4NuKpYb%2FMF28wKwErru4hdRcVKLkA4J6KTGz4G8fFohLEEkH5ktgpRIbMeaszt9QHw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880d497b6e00712f-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal | 104.17.2.184 | 200 OK | 80 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal IP104.17.2.184:443
Requested byhttp://boredimperissvieos.shop/apimdP CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (41702) Hashb28738db4678dda995bcace0bec4ede8 85dc4ac8ab4ee7b7cea4496c4add9417dd2ae8c8 481b84d2a81be1dd13dbb6cb6880a32ad88a546a194b53074ad8dd5b6554b5b2
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/ci5n6/0x4AAAAAAAAjq6WYeRDKmebM/light/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 23:39:05 GMT
content-type: text/html; charset=UTF-8
cross-origin-opener-policy: same-origin
origin-agent-cluster: ?1
cross-origin-embedder-policy: require-corp
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
cross-origin-resource-policy: cross-origin
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
vary: accept-encoding
server: cloudflare
cf-ray: 880d497dec47b51d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|