| strollheavengwu.shop/apieT |  172.67.163.209 | 200 OK | 5.9 kB |
URL User Request POST HTTP/1.1strollheavengwu.shop/apieT IP172.67.163.209:80
File typeHTML document, ASCII text, with very long lines (14388), with no line terminators Hash47705e9434660871461d426d89ff8abf 70f259faa771d86ba90236741137f0a5527d2c0c 051f16041c018d8e7dc461986775d7271ece87bd00de398aa383205e05f85ab6
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /apieT HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 2HyNMraVizh3B3cApzy1oWWgmDnlH4FI1xByx0vpjLjrn34uN7wvCsEIR67CR+1JzYJpCiAw90ei/iz/o5UM/EEeT6BHNeTltHGW+bESEHteAUYgm4guI/mrKfSEvn8Xnt7Gb0PEqK+WK1n6L3mv5A==$Eq55ON+lOUfTI1p19c77rg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dOSB0Gfc0jEIvwhTy8oygNzbukGCfTahIAmAEKEL2gBj9UkYs9il4mG9i5MOEvs5NziMcuZouL21sPFz56CvJOo3lzTvlRBLINKxCxzpYh%2FANVgTER40FyvstdLohKr43%2FTk2ca8ow%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102771ca556b4-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=87f102771ca556b4 |  104.21.15.198 | | 115 kB |
URL strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=87f102771ca556b4 IP104.21.15.198:0
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size115 kB (115267 bytes) Hash8f123a133c71cd5f984d90d3f4e0ca10 2bbad0947431a2ebe51060e12035ddb4eab3372e a7dae19af990fd67e2d0f64e0acc7ddb663f36fbf78dcbbf9f561802c6ae544d
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=87f102771ca556b4 HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://strollheavengwu.shop/apieT?__cf_chl_rt_tk=l1KGZ9MA3dGaLsmcwOSYBC8uPSqLFVH1xXmyjj2D55U-1714915034-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 May 2024 13:17:15 GMT
Content-Type: application/javascript; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3eP9%2FXBoajXggZefTe%2FH7QHjkHMeqtYgmSSvBpOtl09fiW%2B9wV9ule5k48hqCp2nINte%2BkAGy7dQEuH4IVb1f6Y6tpHeLYWlB%2Fyo0QkcB23qgNB95N%2BiE%2FNf8awXKpQO75LwGBBzLA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 87f10278e9a256c4-OSL
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/favicon.ico | 104.21.15.198 | 403 Forbidden | 5.9 kB |
URL GET HTTP/1.1strollheavengwu.shop/favicon.ico IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14478), with no line terminators Hash4de3754006d4ed482ec6b90bc7c55bdb a6cd92e1b948ce4fb74458cebb06beceb6ec8e75 70710803d03d12be98dd675d189968f1ae6d16361e1fca6c477f2ed5b2c4e6c0
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://strollheavengwu.shop/apieT?__cf_chl_rt_tk=l1KGZ9MA3dGaLsmcwOSYBC8uPSqLFVH1xXmyjj2D55U-1714915034-0.0.1.1-1301
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: yZS2/1uivDK6ShaG4EiHWojb4KVFWQmJADdJVPZMfORdeYoGcZmcDAaYO44NmB+npEYANXrDYvrljvK2g4dob9yntRC5TMtcvw/gW809xWB5Neb+KFuHx5T76bvFRLlTq+aTnG+P8rahnUyv6MTv1A==$67sZLJ9Ovl8diZjnVW/Z1Q==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2BUcEWVfSwLrD2JWjpisZ0MZpW6mHFEV9SCj%2FBMdT8A3Mr2ibyQdTw%2FFztlEH6PRNI29pbbNHKa6lmZm9a4BgkSWTgUghVMOb51qw9EIpgBXuNyv2QJY%2FhZhrTg6GH9a6fIMuy65lA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102794a0c56c4-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/favicon.ico | 104.21.15.198 | 403 Forbidden | 5.8 kB |
URL GET HTTP/1.1strollheavengwu.shop/favicon.ico IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14392), with no line terminators Hashd43aad68a570edadd73ab7ddc771ee5c 5e53ef4dc6af5aa67d8e58505c78cf545f991653 ff7f2d4fb0f5ae494102ac5a65788cfaf62422595f681ec03a70c439881eae46
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://strollheavengwu.shop/apieT
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: QzToL6dJ8Lhq7PFlDYaH8A1KJNXta4XmhTewCiJ0K2N4LFVIFVhirOwwPfJHCVlOljte9gGp2usvq8qHeAxlsykZdN2fyyIssjB49PqOKEU8veCAxHXcZCXfnAorEizvK4eBfLP3BpxduQDVs8l1oA==$hpgo1gqnBvK5OKQmEG2r1g==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cy6ZmPeBJJGkvEqZ%2Bls0xyKx39LGXJDzKvnyeh6rVIectWNJsUH3mqSBx7ADyXcNrveeiPLhhdv1wvdCxbuOaRphQh5NUnm4yh7uABnCjJaeIIqxKs29rwEg%2FQtjZjlTT2xOM12d%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f10279bc241bfe-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 | 104.21.15.198 | | 12 kB |
URL strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 IP104.21.15.198:0
File typeASCII text, with very long lines (16376), with no line terminators Hash0310d142c41636b8d047e657c71bc204 7ea6c76101a4262ea0a1a3a1641e83c1ebbf25aa fa5f376e2fa2394bf290978938a80963a84568eedcc7b91eae23bb22d74a4ef9
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://strollheavengwu.shop/apieT
Content-type: application/x-www-form-urlencoded
CF-Challenge: 97b38535daee3f8
Content-Length: 1862
Origin: http://strollheavengwu.shop
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 May 2024 13:17:15 GMT
Content-Type: text/plain; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-gen: cLc7C6tal5ZNOQGq9zYR7gAIbrm0YXwlDKenKYxsJCji5Cd6dzqudZGC2MDP9qGz$dLE4Pj2vLKclBYrMxngjmQ==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkoVFjuciCeUUHbWQgbG9dRbURupMe31udUxBLgM7BtdKi9lyLJb%2FiG5SuYMuSaEEYpYx0E9Fp1qPklQa%2BL8lEUxjhT9h6CBFSECgfxIseKjnz%2BBolv%2FB1h9Wm5tXjOd7x0z249zVA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 87f1027aaf1b56bd-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.2.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.2.184:0
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/g/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0yu07/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 05 May 2024 13:17:15 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 87f1027c1e2ab524-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/87f1027b8d8fb524/1714915035883/sGo48sjxNuzvHIn | 104.17.2.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/87f1027b8d8fb524/1714915035883/sGo48sjxNuzvHIn IP104.17.2.184:0
File typePNG image data, 21 x 60, 8-bit/color RGB, non-interlaced Hashf1b3bf08a1e69b27054c3b55d4c53526 765e16fd516a84b7f3cf5553741ac951056b845a a664011c6a690718ddd0d334a6851ce1c30e245f0c13e74b94f246088b8af734
GET /cdn-cgi/challenge-platform/h/g/i/87f1027b8d8fb524/1714915035883/sGo48sjxNuzvHIn HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0yu07/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 05 May 2024 13:17:16 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 87f102820c6ab524-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd | 104.17.2.184 | | 112 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd IP104.17.2.184:0
File typeASCII text, with very long lines (65536), with no line terminators Size112 kB (112347 bytes) Hashbf53f8c6f7fcf8e38ecd73a18f7832ac c6f69c48a3d388345cc2bc8f74f97c880bcc5f1e 34c559620e03fcfa19b7d82cb5e1fcff41bf9cf2407d105d30a7c9d17259fcb5
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0yu07/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: ee13c765de0aedd
Content-Length: 3511
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 05 May 2024 13:17:15 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: +LI1sxcHsNjbLyI/buSM5rhAnchKq3HXGyGLvyTMVphXvPRX0O9tV2MYYnDjmrSwovJDT7fnS2cXZkv5FaEGorTe4Bx2l8FSKbhDIJJLPkXxNjTmRWy+W1fFEn1N71Ee1ZQgCau5KrGfZ7V8CzPDgi8tRVq0zwfdwbz2pkomKfbW0Uxdo842/hMiMiy4OS0tVw7YmJzAkf7mDkYTwu7BoljEXxDDbnob6KM9407CtrQy9L/fn/NB+HdAe0WJa2HvAZiaA/sx5mkPJkIKRKFgUaV96mqtUNun1OFSyvwzPYqc0f2PmDQGKrx1WkRqiEGDPcuSi4Jz9fvv0Cb1WGesv2ujgo0hFF0Gigwwt2GOvXNq5lua31UcWzdWBSRhcu5FDyoH0XHiZsyiJnXIG8QcHK7NH0fKpmVjiUQiCxUO7kojOYugW6jKsHA/2KtFL/NdnS7zxllkKf9FmLBjqd1DMwJTulGI5oKwlmFSqCm6gYSKiApoTNYrKWXsZSc8p3v8$N58Lded8hBGkxXisT8ny0g==
vary: accept-encoding
server: cloudflare
cf-ray: 87f1027e2861b524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 | 104.21.15.198 | | 2.5 kB |
URL strollheavengwu.shop/cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 IP104.21.15.198:0
File typeASCII text, with very long lines (3240), with no line terminators Hashc7bafd013c1c5dbbfb4f20fa340c8c83 f7227d334d42ad8f65309bf2a32f344f23741b16 2d8c4201f909403f057aee4e01dd0fbb28157d7e4c56ec13e5dc7e7afad529f9
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/545177856:1714908572:yfUVjyVCXwhoForcDyl1YT45_t39CxV65K5SEijacLk/87f102771ca556b4/97b38535daee3f8 HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://strollheavengwu.shop/apieT
Content-type: application/x-www-form-urlencoded
CF-Challenge: 97b38535daee3f8
Content-Length: 3311
Origin: http://strollheavengwu.shop
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
cf-chl-out-s: G/uu1GVVuo2wAMicN7YTZQ==$u+Ilt2XI0MZs6q5M8JJuhg==
set-cookie: cf_chl_rc_i=;Expires=Sat, 04 May 2024 13:17:22 GMT;SameSite=Strict
cf-chl-out: yrL1iiJ5On812XH1cLOE++B0H3b2MdMfK/yPGm9WzRvQNMLdT5GUvvInMKERaMMA/oBjzDzcOG1cQ1pn6vp1oyeCYrP4VFHUZE6ktuD7phJPRuINMtb6FYVIMVAN3qss$Bknzm+dDVrq0LuRCbEH0ZA==
vary: accept-encoding
content-encoding: gzip
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nc%2BdpV07oYrl3l4lPvsHai1Wy7Ip%2BozAMp5Ej7Zc2f8V8h%2FNl1GfyUEDmLkQR228Gy3YrpLZ0ZZOwrlEpwFQogHFETTR79UdmEz2wHML9OFzNMqc1o4afupOUoLULchFN81adhmOSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 87f102a61fd056bd-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd | 104.17.2.184 | | 26 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd IP104.17.2.184:0
File typeASCII text, with very long lines (22316), with no line terminators Hash6690378f5c6c1b8d04ee054b18d24513 5b11a2334e8da1d0566ea3d83ccc9a196fb8091c 5a7970eac730aa87969c32816c7e582e74502d327e656c6202c7cb969ab9aa7e
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1835231999:1714908583:VD9vTn_XtwvjgRKdvsi03mWoqx9csk-XTOXmuRtLy64/87f1027b8d8fb524/ee13c765de0aedd HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/0yu07/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: ee13c765de0aedd
Content-Length: 27708
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 05 May 2024 13:17:18 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: wqchErEueLPslRO+EW+XPNE9uoT5iDYR0vzH7jydqqGmzI17T18y0t+SoxloVPl9$ZnnIq5cNwgqx4X44LjuuIg==
vary: accept-encoding
server: cloudflare
cf-ray: 87f102916e70b524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| strollheavengwu.shop/core/panel/icons/tabler-icons.min.css | 104.21.15.198 | 403 Forbidden | 6.0 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/icons/tabler-icons.min.css IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14643), with no line terminators Hash34d9df4a2160dbeb5000cab0e5fb6fc9 600d373e9efb7226bc97a7aff15efc4146be1453 525e17db11188a27f564aaecd622219b48219ae2119373060584c3a2ab2e07dd
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/icons/tabler-icons.min.css HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: S6RWIcGMsIw9HtE2hJQvCjOJFgztNHsuan+ZMCtE967hxS3CM19O+prgSqyIT3tIvCBYDv04hE+b/L9J32Ld2zuO8MyQFlm0wdFdyJVNKbVm0h58pJ5WYTq/dEzf6al59OonxOnivhb42HDcMfud7w==$ENA097Ww05VUMSo9mC9euA==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qzzA3mLOXXQI%2Fw8eGF1amY%2BDDJDQ%2F0U0yRNBqU4%2BCKml%2By0Yn8fVuwqrgr3NEQoBtfAtAlbXVxo5FacaIyMawSkJt5VxsxZOYL1UGVjwYylka6ezWePO07dQII%2BUyuHIdzPVWwkI%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a7c93456bd-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/core/panel/css/dober.css | 104.21.15.198 | 403 Forbidden | 6.0 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/css/dober.css IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14545), with no line terminators Hash5c31e889e6c5d8a5670339757b4db45e a4ab74ec8d80b7d1bf1b7cba3f58c6bd15ad9ba2 bdf5a304cfbc98c4735b4b82d2df65adcaaed650764a8d6eec4937f682abb087
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/css/dober.css HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 9rG2VY/xZmuGwkNmbNhEOWv+FmwEwnNT+0drsRrz6RNr0A/hIpebxiTHujnLoh9frzeb+MXg7+KaobloPcuxozr2rtAovvDsSumER+wfO9aUISdpBIzDy2DBWJMMIv4nQDVLxAP2YuPbdrPXtYXJ4A==$mqn9K47Y8XL/PqbbX1gS5Q==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TC1Xz9LkYFkRlGSsrkPxHa3J81FmCE4sq5R%2BapA2qCbCPvye7SBsf%2B%2BolJHVub73tCIoP%2F4wJEN5U5slyJ%2B9fQtLXTlTEUSSGEJaoOXDnEtMHei4aWtBCsqZ8xgHm2FuH%2BC6N7EMnw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a7cd517127-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/core/panel/js/doberman.min.js?2 | 104.21.15.198 | 403 Forbidden | 6.0 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/js/doberman.min.js?2 IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14596), with no line terminators Hashcb25d02ed4ab6e81e77cb8e21270fa7a 3257fb86053524f3fe845a674950778aca32c6d5 c4fb1ff6aa4182930dea59c23be7535c87f700e81723dd3ef7545f0e43b61fd5
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/js/doberman.min.js?2 HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: rqvHz+l4fcNjG0wEj+TA0hI22KQYkVhAwYCV0SlFYJEM1oGfpEauNjtamkKoB8v0KAQ7WOxr1/WWMZebKBY66t6L9E3Igh0pwn69qQjfM4tdWKMCiG8xsEaYRGpMzMnBD2yL956KPtv6XIMcTGHnyg==$xC8p4J1vDdLsgEqNRQuRqw==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q0VdaAbAAQt8UDPv5Ibev%2ByELhGg2pHJaetAbE7DsOyCBXZtyaWcwDA%2BaxBGwULkhfIz71DZFZpCp0UDiFNniLxj7C%2BShDe%2Bo3uMHmDnj%2FGHw63aB3TZ2jlwKI7WOTuP461BTCpKsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a7dac956b9-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| cdn.jsdelivr.net/npm/tom-select@2.3.1/dist/css/tom-select.css | 151.101.129.229 | 200 OK | 2.7 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/tom-select@2.3.1/dist/css/tom-select.css IP151.101.129.229:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGlobalSign nv-sa Subjectjsdelivr.net Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09 ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT
Hashc95b0bc73baee2d4aa8a5d31819916c7 5c6101d999331d9dd4f6902ec76fa484cc0e6150 c8168f6b45f8cf03ee444c7a0d2d61850899fd10dd13e2e523ca15e24fb1340c
GET /npm/tom-select@2.3.1/dist/css/tom-select.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 2.3.1
x-jsd-version-type: version
etag: W/"2618-XGEB2ZkzHZ3U9pAux2+khMwOYVA"
content-encoding: br
accept-ranges: bytes
age: 2791982
date: Sun, 05 May 2024 13:17:22 GMT
x-served-by: cache-fra-eddf8230097-FRA, cache-hel1410029-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2714
X-Firefox-Spdy: h2
|
|
| cdn.jsdelivr.net/npm/tom-select@2.3.1/dist/js/tom-select.complete.min.js | 151.101.129.229 | 200 OK | 18 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/tom-select@2.3.1/dist/js/tom-select.complete.min.js IP151.101.129.229:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGlobalSign nv-sa Subjectjsdelivr.net Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09 ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (1002) Hashcb0a959ac3d7a23dd8271f8438671211 8bc8a58a48d6f529e6b58e235b47d92dc61a0e2d 28d785eb15b9a3fb56d6869ee57952e0908d003a0cf911eaae7a14a8bea9bc76
GET /npm/tom-select@2.3.1/dist/js/tom-select.complete.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 2.3.1
x-jsd-version-type: version
etag: W/"c620-i8ilikjW9SnmtY4jW0fZLcYaDi0"
content-encoding: br
accept-ranges: bytes
age: 964259
date: Sun, 05 May 2024 13:17:22 GMT
x-served-by: cache-fra-etou8220055-FRA, cache-hel1410029-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 18451
X-Firefox-Spdy: h2
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP151.101.130.137:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://strollheavengwu.shop
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sun, 05 May 2024 13:17:22 GMT
age: 771223
x-served-by: cache-lga21931-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 3, 577428
x-timer: S1714915043.650081,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| strollheavengwu.shop/core/panel/css/dober.css | 104.21.15.198 | 403 Forbidden | 5.9 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/css/dober.css IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14545), with no line terminators Hash6f6329af0606064bce1e1741056a02fe b9d8f40d6c58e01d91bcf58f5415683587a19c98 9e9dae3058727735790e0a41361e6342c86e00163976be74163007e27055e8d0
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/css/dober.css HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: A1QLrk2YpKnHcomuEOjjcf7R/MjkhNSuAs6sTEnXZ1B21zHNoZjkpkazZKozrx1h98qfMHuEEmSh6SSU6aA9h2+a/YMIWOmZcoUMCLmDuOF6WeZQnywZdWWFNcEWul3JlfHllLVE7WteX73UwhNXiw==$laQo4d3Nqw32TQcnVKaLrg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vrIOOrPqi1t8A5QH3fQ%2FTNi0BK3TOgU8lH%2BT%2BTOWLsbT0SXgdrAovPTSycHrq9jT2prRRIOm8DDjYON7l7tYeoMB2NhfmxFKFwVkkMLc3MmJwCwrPIF59KSvZBs2I%2BMK7AbFlL4GBA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a97ba7b50f-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/core/panel/icons/tabler-icons.min.css | 104.21.15.198 | 403 Forbidden | 6.0 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/icons/tabler-icons.min.css IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14642), with no line terminators Hash1a9809e6818fa7864c5885a61766c436 e6c9e75b92ddfe1cd336763f016769636f30ff4d 0e846ff0f59ed3d79d932565cfcf384176dbea5d4a953f0cbf94fc839dc5b227
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/icons/tabler-icons.min.css HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 4cNkvJKcuXgJ1IUNbBiSLVlYb55cufsVtIRoW4Ga0/pPJlu5eTTfTFy5BVpEy9dKkv/GgwmzZ/T9GN8RVx7zoJ8duIK9xnykNBOI2cy0fMwhZsoSCJueAX/fMy///xB1AkEkEX4rovX3fpwUZMuA8w==$5H+aZaZJGTjkb2hChM1EmQ==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mENG2x%2ByiEoGr%2B7FVwF4y%2Btwo8GaKic3Zir5vDLhue%2F03iWYouU64SBgNmOnxsH4I1G3aoySB1CftMlB8o1ATvl263FmKanUarXyCek7cVTowKjhYA00%2F1ijPvk0tNQLP98XftjIHg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a97cc456b7-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/core/panel/js/doberman.min.js?2 | 104.21.15.198 | 403 Forbidden | 6.0 kB |
URL GET HTTP/1.1strollheavengwu.shop/core/panel/js/doberman.min.js?2 IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14575), with no line terminators Hash9aef290406d90b728d1783b58ca5c84d 8904fa29b0de7901e1d496041a278d5ca9a9e8ae 8f8312d5989c75fb58639b674dee0793a615332fe439b742b4ec7d13c9f325d7
| Analyzer | Verdict | Alert |
|---|
| mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /core/panel/js/doberman.min.js?2 HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: 2Zk8L/NLNAOels07giHA7BoYpCwJJZxkdDzBK2RkRTe+oBqB3LRpsfWw8QvtbO5PdEOLxmQ0jfJVlMxl3xyZdHZyvnnCF3kvS5ahdxBWDFozsF+zzKKMzSCh+c1lCRLdZ7HOKuFEPxGJBqKhOVtjcQ==$ZiFssH/aL8wClVSuLR5fHg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LVEDMiiIc6yek3dVnMKRZ1R4JBKXZ5dR1Lmn7T9IpDQ%2Bxva9XQWly51sw7i4IZCjeLivWeE26O2IEuHY6vK%2BrihTHXnK2pf8l1dBuaNl1%2B6NnenIBIVRZIdWDerVApFzNFbd7aaGPw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a9abf30b3d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| strollheavengwu.shop/favicon.ico | 104.21.15.198 | 403 Forbidden | 5.9 kB |
URL GET HTTP/1.1strollheavengwu.shop/favicon.ico IP104.21.15.198:80
Requested byhttp://strollheavengwu.shop/apieT
File typeHTML document, ASCII text, with very long lines (14435), with no line terminators Hash1447a8e02e0c72f92be64e0e1619d6c6 4707062c5237b7968eb4dd055a034fe1e0bdbb30 771621a96863df27b7fcdf7a7d81b02280a8eaac0029af7fde5fd487413a9d45
| Analyzer | Verdict | Alert |
|---|
| ThreatFox | malicious | Lumma Stealer | | mnemonic secure dns | malicious | Sinkholed | | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: strollheavengwu.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/apieT
Cookie: PHPSESSID=8hbp2ik8hoaas5ocriituhsvpp
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Date: Sun, 05 May 2024 13:17:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: n4EUApoGH83DRKKTkKH9e8fzSkPAcUAIRhQRUasnrQ3MUKx/kK95iUFdqz329p2oexvyYbkhXPyPk6ZFCleokFnRjUFOyIhKPULBiFVtwIRlM+LpHSZH7BZi5iWqzwqfPhmhjZu/kUN4GlbLwM55Pg==$0Z3tu0AYtphG/sE2taXiLw==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pVeDoHtuX9BdAdvNzOb8vLtkaYGrmrwUNVauK2ZtrYXpbTNloPAJOosaeXVzURWPgkcUQo0kF7lnKBKgi6pUin7YSvhIs%2BqasmGe%2FnO1jiF16RdCi7euoGRJe%2FgQvCZq01vfolWhkA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87f102a9d967712a-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
|
|
| unpkg.com/@tabler/core@1.0.0-beta10/dist/js/tabler.min.js | 104.17.249.203 | 200 OK | 143 kB |
URL GET HTTP/2unpkg.com/@tabler/core@1.0.0-beta10/dist/js/tabler.min.js IP104.17.249.203:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Size143 kB (143157 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /@tabler/core@1.0.0-beta10/dist/js/tabler.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 05 May 2024 13:17:22 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "22f35-n38SF7G8IIAzpB/oRMejvoNjWT0"
via: 1.1 fly.io
fly-request-id: 01HWT9Q1M3DF7ZJBTNTCM8J240-arn
cf-cache-status: HIT
age: 340483
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87f102a82cd356b4-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-flags.min.css | 104.17.249.203 | 200 OK | 16 kB |
URL GET HTTP/2unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-flags.min.css IP104.17.249.203:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /@tabler/core@1.0.0-beta10/dist/css/tabler-flags.min.css HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 05 May 2024 13:17:22 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "3dee-nKAPWTieQ/tpCdi7lKfJqVdDhu8"
via: 1.1 fly.io
fly-request-id: 01HWT9Q1M7PZ9HX1HQ5ARQCQDX-arn
cf-cache-status: HIT
age: 340483
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87f102a82ccd56b4-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-vendors.min.css | 104.17.249.203 | 200 OK | 20 kB |
URL GET HTTP/2unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-vendors.min.css IP104.17.249.203:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /@tabler/core@1.0.0-beta10/dist/css/tabler-vendors.min.css HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 05 May 2024 13:17:22 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "501d-KzRlg0kTrqxbPtPfiexL7OQBp7U"
via: 1.1 fly.io
fly-request-id: 01HWT9Q1MGHYRDJDVVHBH00JR8-arn
cf-cache-status: HIT
age: 340483
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87f102a82cd956b4-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-payments.min.css | 104.17.249.203 | 200 OK | 10 kB |
URL GET HTTP/2unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler-payments.min.css IP104.17.249.203:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /@tabler/core@1.0.0-beta10/dist/css/tabler-payments.min.css HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 05 May 2024 13:17:22 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "2806-kjKGJgq4giZtHvKvnmBtsP+a/jU"
via: 1.1 fly.io
fly-request-id: 01HWT9Q1MTTN73MFFH569S9PMD-arn
cf-cache-status: HIT
age: 340483
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87f102a82cd656b4-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler.min.css | 104.17.249.203 | 200 OK | 300 kB |
URL GET HTTP/2unpkg.com/@tabler/core@1.0.0-beta10/dist/css/tabler.min.css IP104.17.249.203:443
Requested byhttp://strollheavengwu.shop/apieT CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
Size300 kB (300441 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /@tabler/core@1.0.0-beta10/dist/css/tabler.min.css HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://strollheavengwu.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 05 May 2024 13:17:22 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "49599-nWlRizNidNMAgcjSv4f3utVNqHY"
via: 1.1 fly.io
fly-request-id: 01HTZRWFWVX5PFVQX8X8E63WZY-arn
cf-cache-status: HIT
age: 2304288
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 87f102a82cc456b4-OSL
X-Firefox-Spdy: h2
|
|