WEBSITE ANALYSIS REPORT

http://pornkrm.com/e/ugmxnbpuwlva

01 Mar 2026 · 07:47:33.000 UTCpublic

Report tags: malicious clickfix
Submit tags

Request review

Malicious detection

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

07:47:07.849 GET 302 document 130.0 KB 88 ms —

07:47:07.903 GET 200 document 130.0 KB 431 ms —

07:47:08.458 GET 200 stylesheet 2.4 KB 408 ms —

07:47:08.460 GET 200 stylesheet 264.3 KB 46 ms —

07:47:08.466 GET 200 script 85.5 KB 61 ms —

07:47:08.467 GET 200 stylesheet 5.5 KB 38 ms —

07:47:08.469 GET 200 script 1.7 KB 35 ms —

07:47:08.471 GET 200 script 156.1 KB 68 ms —

07:47:08.475 GET 200 script 81.2 KB 70 ms —

07:47:08.479 GET 200 script 97.2 KB 169 ms 2 alerts

07:47:08.480 GET 200 script 78.8 KB 64 ms —

07:47:08.482 GET 200 script 100.4 KB 69 ms 1 alerts

Transaction #14

Request / response

URL

GET HTTPS

https://lancewhosedifficult.com/s/js/site.min.js?fe1eebe79ae88e4bfa6ed669174fca9c

IP / ASN

186.2.163.224

AS59692 · IQWeb FZ-LLC

Requested by: https://lancewhosedifficult.com/e/ugmxnbpuwlva

Resource information

File type: JavaScript source, Unicode text, UTF-8 text, with very long lines (52119)
MIME type: application/javascript; charset=utf-8
First seen (UTC): 04 Oct 2025 · 08:15:13.352 UTC
Last seen (UTC): 27 Sep 2026 · 07:25:12.592 UTC
Times seen: 302

Size: 100.4 KB (102814 bytes)
MD5: f221d7962c60ad362e2fbc5e1dacc9e6
SHA1: 9e2a0ee15fec83034ee0eedfdc866d2d7472ecee
SHA256: efd0ced2b4c5c6490d8ac3462669df8c5aa143db9ef81fc947dc3ffc739d4088

Certificate information

Issuer: Let's Encrypt · R12
Subject: lancewhosedifficult.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: F6:E4:1F:31:D7:A1:0D:2C:83:C3:CB:1C:A7:01:13:17:B3:2B:F1:7B
Valid from: Wed, 18 Feb 2026 22:39:42 GMT
Valid until: Tue, 19 May 2026 22:39:41 GMT

Technology fingerprints

DDoS-Guard (Security)
HSTS (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Malicious - Copy/Paste Social Engineering (ClickFix)	medium	Malicious

HTTP headers

Request headers

GET /s/js/site.min.js?fe1eebe79ae88e4bfa6ed669174fca9c HTTP/1.1
Host: lancewhosedifficult.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lancewhosedifficult.com/e/ugmxnbpuwlva
Cookie: __ddg8_=eY7YX6jSuaWwyvB5; __ddg10_=1772351228; __ddg9_=91.90.42.154; __ddg1_=UWVv0laTmL3ojDYz8AJB; XSRF-TOKEN=eyJpdiI6IlhDY3JubnBtUmRqdENvRzNwYUVCMFE9PSIsInZhbHVlIjoiNy9GL0V2SmxXbkJsQWxHVlhJQUp3cmY4aWVoUUI5NFUvMkZTM2UvVjNwTEtxeHpmWlp3WkhMYUVpZUd2Sk5HTkQ1akFCSUlYem9ibEwvY2lRb3VSalBJZWFWY0I2emQybkF5YlgwRVJpaUdlNU1wNzcrbEYxRTZFUmtJeEtqK1AiLCJtYWMiOiIwYjY0YjFkYTUwN2FiYjQ0MWM1ZGU0M2ZjMmNlOWZmNGY0ZmMyNzYzNTgxMDE2MGY4MGExMjUyZmQ5NzgzNjg4IiwidGFnIjoiIn0%3D; voe_session=eyJpdiI6ImNKTG5kTzgyK054TmxJbFI3VHVOV0E9PSIsInZhbHVlIjoiKytwL09WcVNBSVVJVlFjb211SFA5VC9oMGZJdzY0S0QvcjQ0K1NMd3NDTWIzcTJpWjhiM0IwZkVwUzVrR2YrS3JhNnFrenFpYUFsT3VNWkp2RXZPUUZmdVNtUVZ6Wnd4a1dvMUdhMVZ5d0c4Wkd3bWc4eVhFQXh6UjN4ZkczTHkiLCJtYWMiOiI3ZWYxZWZiOTQzMzAzZjVlZGJjYzVmMDAwNmU5OGRiMGQ4MThjZDcxMzgxYjAyYzNmMzZjNTFhMTNhMDQ4ODQyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg8_=VYYRSVx5848Uw7Lt; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 01-Mar-2026 08:07:08 GMT
__ddg10_=1772351228; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 01-Mar-2026 08:07:08 GMT
__ddg9_=91.90.42.154; Domain=.lancewhosedifficult.com; Path=/; Expires=Sun, 01-Mar-2026 08:07:08 GMT
strict-transport-security: max-age=2628000
content-security-policy: upgrade-insecure-requests;
date: Wed, 18 Feb 2026 23:38:55 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 03 Oct 2025 21:05:04 GMT
etag: W/"68e03a80-1919e"
expires: Fri, 20 Mar 2026 23:38:55 GMT
cache-control: max-age=2592000
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
age: 893293
content-length: 23409
ddg-cache-status: HIT
X-Firefox-Spdy: h2

07:47:08.615 GET 200 script 460.0 KB 320 ms —

07:47:09.064 GET 200 xhr 126 B 160 ms —

07:47:09.067 GET 200 img 403 B 38 ms —

07:47:09.101 GET 200 script 65.8 KB 40 ms —

07:47:09.127 GET 200 script 334.9 KB 46 ms —

07:47:09.131 GET 200 script 560.9 KB 73 ms —

07:47:09.133 GET 200 font 19.7 KB 310 ms —

07:47:09.277 GET 200 script 5.0 KB 32 ms —

07:47:09.397 GET 200 img 6.9 KB 36 ms —

07:47:09.399 GET 200 img 533 B 35 ms —

07:47:09.476 GET 200 subdocument 926 B 18 ms 2 alerts

07:47:09.542 GET 200 img 3.6 KB 38 ms —

07:47:09.617 GET 200 xhr 12.0 KB 119 ms —

07:47:09.631 GET 200 img 82.5 KB 218 ms —

07:47:09.839 GET 200 script 6.2 KB 19 ms 2 alerts

07:47:09.865 GET 200 img 252.1 KB 51 ms —

07:47:09.874 GET 200 img 41.2 KB 175 ms —

07:47:09.881 GET 200 img 476.8 KB 180 ms —

07:47:11.905 GET 200 img 43 B 19 ms 2 alerts

07:47:12.918 GET 200 img 43 B 18 ms 2 alerts

http://pornkrm.com/e/ugmxnbpuwlva

Domain graph

Hostnames

Connections

Network requests

Transaction #14

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://pornkrm.com/e/ugmxnbpuwlva

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #14

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://pornkrm.com/e/ugmxnbpuwlva

Domain graph

Network requests