gwgw.ga/webd/20220127/webd-20220127-win32.7z
0 B URL gwgw.ga/webd/20220127/webd-20220127-win32.7z
IP
ASN #133618 Trellian Pty. Limited
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /webd/20220127/webd-20220127-win32.7z HTTP/1.1
Host: gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
date: Wed, 09 Aug 2023 11:55:21 GMT
server: Apache
set-cookie: __tad=1691582121.8695967; expires=Sat, 06-Aug-2033 11:55:21 GMT; Max-Age=315360000
location: http://ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
content-length: 0
content-type: text/html; charset=UTF-8
connection: close
ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
1.3 kB URL ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (357)
Hash 4785bb5637d0380b982946d133cb04f7
285e2d65e3fb5dacd1e7c68c8a49c26183afeea5
c35e0250a954204f3809c1f2f5369613646816ffb2fe263a2e09263b946b5893
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ga domain
GET /webd/20220127/webd-20220127-win32.7z HTTP/1.1
Host: ww38.gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Aug 2023 11:55:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Redirect: zeropark_zeroclick
X-Buckets: bucket011
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_VA399L52eWQtLmWsVZRWH5Qq1Kc8cLzttkwslftPnMG0x8g2Ut0HZtDk5MJcJbvd0GteTYpoVu+csqGc9byq8Q==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Domain: gwgw.ga
X-Subdomain: ww38
Content-Encoding: gzip
d38psrni17bvxu.cloudfront.net/scripts/js3.js
1.1 kB URL d38psrni17bvxu.cloudfront.net/scripts/js3.js
IP
File type ASCII text, with very long lines (468)
Hash a66b149a7ebc798955373415d683f32a
15ceaba8cfae8368600620ae97aa26ae7331d626
036c94653e84e6078c087abeb3ac8804491d27b27938839ae3df42b31e2238d9
GET /scripts/js3.js HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww38.gwgw.ga/
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 1096
Connection: keep-alive
Server: nginx
Date: Wed, 09 Aug 2023 03:41:20 GMT
Last-Modified: Mon, 23 Jan 2023 11:12:07 GMT
Accept-Ranges: bytes
ETag: "63ce6b87-448"
X-Cache: Hit from cloudfront
Via: 1.1 98794c1dec0d4e7b10ddf0faa094cf94.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: rwnJM8ZHOPNaoWINOvoqpTOY390YSE_wW3Jp2lUueBMdA1iH5r1Vog==
Age: 29643
ww38.gwgw.ga/track.php?domain=gwgw.ga&toggle=browserjs&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D
20 B URL ww38.gwgw.ga/track.php?domain=gwgw.ga&toggle=browserjs&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D
IP
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ga domain
GET /track.php?domain=gwgw.ga&toggle=browserjs&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D HTTP/1.1
Host: ww38.gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Aug 2023 11:55:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ww38.gwgw.ga/ls.php?t=64d37eaa&token=db9bdefef03bef0f253a3ebf2deff11bf9d4165c
16 B URL ww38.gwgw.ga/ls.php?t=64d37eaa&token=db9bdefef03bef0f253a3ebf2deff11bf9d4165c
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 7363e85fe9edee6f053a4b319588c086
a15e2127145548437173fc17f3e980e3f3dee2d0
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ga domain
GET /ls.php?t=64d37eaa&token=db9bdefef03bef0f253a3ebf2deff11bf9d4165c HTTP/1.1
Host: ww38.gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 201 Created
Date: Wed, 09 Aug 2023 11:55:23 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 64d37eab24cb2d05ea0e269d
Charset: utf-8
Access-Control-Allow-Origin:
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_Lm5ehREazNxP520toEs4AslWXQiw1TCyveWOW0ks3PTwXGAcBRNaWM2GRT/eV9C1FmtwQk6no0HoyafzDe+dow==
ww38.gwgw.ga/favicon.ico
0 B IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ga domain
GET /favicon.ico HTTP/1.1
Host: ww38.gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Aug 2023 11:55:23 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes
ww38.gwgw.ga/track.php?click=929aab2b14f70a543ca1e014a71c4cd6b6d3ee23&domain=gwgw.ga&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D&ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NGQzN2VhYTRjYTlifHx8MTY5MTU4MjEyMi42MDZ8NjRkMDFiYmJhMjlhODA3MWMzZTM0NTA5NDMxNWJiY2VmZmJlZGI2Nnx8fHx8MXx8MHwwfHx8fDF8fHx8fDB8MHx8fHx8fHx8fHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGRiOWJkZWZlZjAzYmVmMGYyNTNhM2ViZjJkZWZmMTFiZjlkNDE2NWN8MHx8MHwwfA%3D%3D&kw=&search=&pcat=&bucket=&clientID=&adtest=off
20 B URL ww38.gwgw.ga/track.php?click=929aab2b14f70a543ca1e014a71c4cd6b6d3ee23&domain=gwgw.ga&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D&ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NGQzN2VhYTRjYTlifHx8MTY5MTU4MjEyMi42MDZ8NjRkMDFiYmJhMjlhODA3MWMzZTM0NTA5NDMxNWJiY2VmZmJlZGI2Nnx8fHx8MXx8MHwwfHx8fDF8fHx8fDB8MHx8fHx8fHx8fHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGRiOWJkZWZlZjAzYmVmMGYyNTNhM2ViZjJkZWZmMTFiZjlkNDE2NWN8MHx8MHwwfA%3D%3D&kw=&search=&pcat=&bucket=&clientID=&adtest=off
IP
File type gzip compressed data, max speed, from Unix\012- data
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
NIDS Severity Alert suricata medium ET INFO HTTP Request to a *.ga domain
GET /track.php?click=929aab2b14f70a543ca1e014a71c4cd6b6d3ee23&domain=gwgw.ga&uid=MTY5MTU4MjEyMi4zMTQxOjg0ZWE0OTYxNmZjMDUzM2YyZTI2MTBkYTEzYjc3NjJiYjU0OTI4YjQ1M2NjYmNjN2U4MmUxNGVhYjA4M2UyMWY6NjRkMzdlYWE0Y2FkZg%3D%3D&ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NGQzN2VhYTRjYTlifHx8MTY5MTU4MjEyMi42MDZ8NjRkMDFiYmJhMjlhODA3MWMzZTM0NTA5NDMxNWJiY2VmZmJlZGI2Nnx8fHx8MXx8MHwwfHx8fDF8fHx8fDB8MHx8fHx8fHx8fHwwfDB8fDB8fHwwfDB8VzEwPXx8MXxXMTA9fGRiOWJkZWZlZjAzYmVmMGYyNTNhM2ViZjJkZWZmMTFiZjlkNDE2NWN8MHx8MHwwfA%3D%3D&kw=&search=&pcat=&bucket=&clientID=&adtest=off HTTP/1.1
Host: ww38.gwgw.ga
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://ww38.gwgw.ga/webd/20220127/webd-20220127-win32.7z
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Aug 2023 11:55:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-View-Match: true
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ocsp.r2m01.amazontrust.com/
471 B URL ocsp.r2m01.amazontrust.com/
IP
Hash 475cec9013d006750ebe3ac0ee842558
8305770e3a460f72cb13f8d9894caf8fba6ab3d0
41b60e807c30da338a5c6ef76b2236b7d002bb8818af746cc526a80c7b39f24c
POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Wed, 09 Aug 2023 11:55:24 GMT
Last-Modified: Wed, 09 Aug 2023 11:24:35 GMT
Server: ECAcc (amb/6B04)
X-Cache: Miss from cloudfront
Via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: -ylByzikyi-W6VYHlS34LI-5sW5YsNxGA9iN4RN2NKwYIS0FPm0HOg==
Age: 1849
phanu-swc.com/zclkvisitor/9eb0abb2-36ab-11ee-9c0e-0af92cff8a01/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=9ebc6b82-36ab-11ee-9c0e-0af92cff8a01
1.1 kB URL phanu-swc.com/zclkvisitor/9eb0abb2-36ab-11ee-9c0e-0af92cff8a01/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=9ebc6b82-36ab-11ee-9c0e-0af92cff8a01
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 557d5a456a02ada9e9b185930339ce49
b9d22e9b7f5da6f18609ece0e958211bbd3e46df
53f5f192307941043c58b160d794c297670c4891151684a9ef41f42caf2a2b81
GET /zclkvisitor/9eb0abb2-36ab-11ee-9c0e-0af92cff8a01/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=9ebc6b82-36ab-11ee-9c0e-0af92cff8a01 HTTP/1.1
Host: phanu-swc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww38.gwgw.ga/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Wed, 09 Aug 2023 11:55:24 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
Server: KrDrujHc
phanu-swc.com/zclkredirect?visitid=9eb0abb2-36ab-11ee-9c0e-0af92cff8a01&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false
322 B URL phanu-swc.com/zclkredirect?visitid=9eb0abb2-36ab-11ee-9c0e-0af92cff8a01&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Hash 2e8a4fc7a9a94994bf5ef48c22b4284a
2261e69d741868f80dfb6714fae1f61ceb36fc43
6db374184ef5ba6f6ca5922a3e010f19f0b37b17d591ce06d6f2e2f7a622b3d8
GET /zclkredirect?visitid=9eb0abb2-36ab-11ee-9c0e-0af92cff8a01&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false HTTP/1.1
Host: phanu-swc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://phanu-swc.com/zclkvisitor/9eb0abb2-36ab-11ee-9c0e-0af92cff8a01/85aefdc2-9ed0-48aa-922d-60f9f9fc0f2d?campaignid=9ebc6b82-36ab-11ee-9c0e-0af92cff8a01
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200
Date: Wed, 09 Aug 2023 11:55:25 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,Content-Type,x-exadsrtb-version,x-openrtb-version,x-zerortb-version,X-Flag
redirected: JS
Server: JgqZMooY
phanu-swc.com/favicon.ico
653 B URL phanu-swc.com/favicon.ico
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (649), with no line terminators
Hash ba2732b1b2fa2626ffaa15f62f9e7d66
203d4e7fbb1d80449d6e4e1f3ae7a9bf8625debe
879861cb72fe9fbb476dab246021c4c83b4066327de2529e05ec54d3afb0a1c8
GET /favicon.ico HTTP/1.1
Host: phanu-swc.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://phanu-swc.com/zclkredirect?visitid=9eb0abb2-36ab-11ee-9c0e-0af92cff8a01&type=js&browserWidth=1280&browserHeight=1024&iframeDetected=false&webdriverDetected=false
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404
Date: Wed, 09 Aug 2023 11:55:25 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 653
Connection: keep-alive
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
x-content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'
X-WebKit-CSP: default-src 'self'; script-src 'self' 'unsafe-inline'
Content-Language: en
Server: kelsiQCc
xml-v4.discoveryplugs-1.live/click?seat=2113743&i=mHoCY7KRm4Q_0
302 Found 0 B URL User Request GET HTTP/1.1 xml-v4.discoveryplugs-1.live/click?seat=2113743&i=mHoCY7KRm4Q_0
IP
ASN #27257 WEBAIR-INTERNET
Certificate IssuerLet's Encrypt
Subjectdiscoveryplugs-1.live
Fingerprint9E:3F:C3:64:6E:CF:F5:15:F2:F2:8C:82:E1:EB:CE:CF:9F:73:67:9E
ValidityMon, 07 Aug 2023 15:42:46 GMT - Sun, 05 Nov 2023 15:42:45 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?seat=2113743&i=mHoCY7KRm4Q_0 HTTP/1.1
Host: xml-v4.discoveryplugs-1.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://phanu-swc.com/
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Wed, 09 Aug 2023 11:55:25 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Age: 0
Location: https://main.proffering.xyz/15GtWZ?zoneid=13686689518&pubfeed=397303/397303.13686689518&campaign=670550&cost=0.00031
Pragma: no-cache
main.proffering.xyz/15GtWZ?zoneid=13686689518&pubfeed=397303/397303.13686689518&campaign=670550&cost=0.00031
302 Found 248 B URL User Request GET HTTP/1.1 main.proffering.xyz/15GtWZ?zoneid=13686689518&pubfeed=397303/397303.13686689518&campaign=670550&cost=0.00031
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Certificate IssuerLet's Encrypt
Subjectmain.proffering.xyz
FingerprintCC:74:D3:0B:0C:3F:07:75:B9:F5:81:49:D8:3C:BF:DD:5D:E2:10:A2
ValidityThu, 13 Jul 2023 09:37:16 GMT - Wed, 11 Oct 2023 09:37:15 GMT
File type HTML document, ASCII text, with no line terminators
Hash 8fd1faf28af8ca98ab216232623253d0
61b3ab21dfce2eb82bb54b60c7f456f7b3bc7c77
03d13ad82d9590823c714a9c0006e34520a2026927933cef0aa533d6b0f5dc86
GET /15GtWZ?zoneid=13686689518&pubfeed=397303/397303.13686689518&campaign=670550&cost=0.00031 HTTP/1.1
Host: main.proffering.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://phanu-swc.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx/1.23.0
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 248
Connection: keep-alive
X-Powered-By: Express
Set-Cookie: 15GtWZo=20230809141691582740159; domain=.main.proffering.xyz; path=/;expires=Thu, 10 Aug 2023 11:55:26 GMT; httpOnly=true;SameSite=None; Secure;
_pc_lc_id=15GtWZ; domain=.main.proffering.xyz; path=/;expires=Thu, 10 Aug 2023 11:55:26 GMT; httpOnly=true;SameSite=None; Secure;
peerclickcid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809; domain=.main.proffering.xyz; path=/;expires=Thu, 10 Aug 2023 11:55:26 GMT; httpOnly=true;SameSite=None; Secure;
_norg=1; domain=.main.proffering.xyz; path=/;expires=Thu, 10 Aug 2023 11:55:26 GMT; httpOnly=true;SameSite=None; Secure;
Location: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Vary: Accept
teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
200 OK 6.6 kB URL User Request GET HTTP/1.1 teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
IP
ASN #6898 SERVER.swiss Sagl
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (531), with CRLF line terminators
Hash 068d5f1fd3e74e92ba32b2f26521e043
2becbad45e33f83bbc0ee414deb4feef2b1a6e7a
0ba8ea827afabf92d11ea5ccfd57f0e0ad3979537370fd103d2add096299e179
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809 HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://phanu-swc.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/html
Content-Length: 6640
Connection: keep-alive
set-cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux; path=/
cache-control: private, no-transform
ocsp.pki.goog/gts1c3
471 B IP
Hash e629c7fe94965fd426af67704c639d80
e3bd1a5013be1b3301adb61065ff9d43ce2a201c
66a68f08f9b73800e1542b73abe6e5f0a97fda4ed30ed70fb7893b7651d199a2
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 09 Aug 2023 11:55:26 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
teenfinder.online/media/dating/sinderv2/css/bootstrap.min.css
200 OK 110 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/css/bootstrap.min.css
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (65367), with CRLF line terminators
Size 110 kB (109540 bytes)
Hash 03d06426a30f77095d7511e1ca74d225
d1a349294f6fe94ffb17a50097b37bd81e9ba56a
3f7e6f3cb6ba8e2effbdd260131ce0d2f332fb00ba3feca1a5bc9c3ee7f9e2a6
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/css/bootstrap.min.css HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/css
Content-Length: 109540
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "03d06426a30f77095d7511e1ca74d225"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4DBBEB3540E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#430591588/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.430591588Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/js/vegas.js
200 OK 22 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/js/vegas.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
Hash 85310f0fc6d54ab6c4aa2a2efa1e8514
dbd124ed40a22170b23709711d4572ff93c9fe6f
17d0a5e4e45104aec83860cf51f19bb232747a586a74fc841b9771a9aa9e42b2
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/js/vegas.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 21792
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "85310f0fc6d54ab6c4aa2a2efa1e8514"
Last-Modified: Mon, 20 Feb 2023 09:32:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4DC0AEE6249
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676801713#1186412/gid:0/gname:root/mode:33188/mtime:1659086506#637908000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-29T09:21:46.637908Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/css/style.css
200 OK 20 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/css/style.css
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with CRLF line terminators
Hash 481d04e228d83633ad28310d09905526
f5c81ac5514271f64001c41f5b03e92df55c1a02
25fc219b42657e82593f2b07e3d4ae7d615031234f9b2732f5457338d779cf30
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/css/style.css HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/css
Content-Length: 19825
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "481d04e228d83633ad28310d09905526"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B3D42F3378B8
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#430591588/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.430591588Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/cookie/js.cookie.js
200 OK 4.3 kB URL GET HTTP/1.1 teenfinder.online/cookie/js.cookie.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (1709), with CRLF line terminators
Hash a7e9883924072f15259de6888d5ef515
7f4f6e5938e68f55aef81e0cd0145f008cd28382
985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /cookie/js.cookie.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 4264
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a7e9883924072f15259de6888d5ef515"
Last-Modified: Wed, 31 Aug 2022 09:31:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B418E6218E03
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
fonts.googleapis.com/css?family=Roboto:400,300,700|Raleway:400,700&subset=latin,cyrillic
200 OK 1.3 kB URL GET HTTP/2 fonts.googleapis.com/css?family=Roboto:400,300,700|Raleway:400,700&subset=latin,cyrillic
IP
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint76:6B:FF:33:88:3C:50:72:1C:E1:96:2F:6E:FB:D0:D9:32:9D:FF:2F
ValidityMon, 10 Jul 2023 08:21:11 GMT - Mon, 02 Oct 2023 08:21:10 GMT
File type gzip compressed data, max compression\012- data
Hash ff4b4b56a20d651b7a442e73fe0cd2a0
84480d8a4207875f9c8fe1b2058c093249030633
2a80cb38fb9b72284c930c1ae95086d57bd5f446c2642544dab56f6c8715b477
GET /css?family=Roboto:400,300,700|Raleway:400,700&subset=latin,cyrillic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 09 Aug 2023 11:55:26 GMT
date: Wed, 09 Aug 2023 11:55:26 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
teenfinder.online/media/dating/sinderv2/css/vegas.css
200 OK 20 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/css/vegas.css
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with CRLF line terminators
Hash 357c7befa8bdef911f02f48f49e10628
47972e3c4591058dce82dd3b08bed8e0b8ae5c8f
47f3bef4746b798892c7beff212618616b0950f33f416f03db243578f89135e3
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/css/vegas.css HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/css
Content-Length: 19822
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "357c7befa8bdef911f02f48f49e10628"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4DC06691739
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#430591588/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.430591588Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/util/flag-icon/css/flag-icon.css
200 OK 41 kB URL GET HTTP/1.1 teenfinder.online/util/flag-icon/css/flag-icon.css
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with CRLF line terminators
Hash 0a47b937981e7389e3ebe63e4a503066
01b395ad016a1d9d15016d765f7d2c51a6e2809b
d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /util/flag-icon/css/flag-icon.css HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/css
Content-Length: 40627
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "0a47b937981e7389e3ebe63e4a503066"
Last-Modified: Mon, 20 Feb 2023 09:36:38 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B42A95CE416F
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676841679#813157920/gid:0/gname:root/mode:33188/mtime:1655386274#684017000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:31:14.684017Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/util/utils.js
200 OK 7.5 kB URL GET HTTP/1.1 teenfinder.online/util/utils.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (641), with CRLF line terminators
Hash 01816d15ca03032751161a746e2fb7c3
dcc72ea5fa1356490ba473288159df9786b4a3c3
8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /util/utils.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 7512
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "01816d15ca03032751161a746e2fb7c3"
Last-Modified: Mon, 20 Feb 2023 09:36:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B417C34A10B5
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676885559#334512232/gid:0/gname:root/mode:33188/mtime:1659085489#684136000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-29T09:04:49.684136Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/js/timer.js
200 OK 621 B URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/js/timer.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
Hash 40fe503eb84093a37b15e39365ffc587
911128043c901314d283fe478477d26e2b3d821a
60b0f0de4c72c1ce9c05b36ba776f12538b1d9b80858b7099068a3e7e0415bc1
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/js/timer.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 621
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "40fe503eb84093a37b15e39365ffc587"
Last-Modified: Mon, 20 Feb 2023 09:32:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B3D962D7A796
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676801713#1186412/gid:0/gname:root/mode:33188/mtime:1659086506#89907000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-29T09:21:46.089907Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/css/animate.css
200 OK 61 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/css/animate.css
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (460), with CRLF line terminators
Hash 1cbfbb2c4ef85880799a74ab2f290f2a
9b6366d6c7ad05010f7070db70fba10754be6e9c
bfdad6766b12a3826bf32024f0fc13fffbcee84f102034b9270da7e538451031
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/css/animate.css HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: text/css
Content-Length: 61188
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "1cbfbb2c4ef85880799a74ab2f290f2a"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4DC06724285
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#430591588/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.430591588Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/js/trls.js
200 OK 17 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/js/trls.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
Hash eb1b6bc6776b3e1f520ad0d6c03a92ad
5adcdd94fd541e5ff347cb317418f77ebcd7a714
d87b9de60e8a4d614e0f4e34da021c835852d802f8b6de2aee6a3fa034e3b2b5
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/js/trls.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 17300
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "eb1b6bc6776b3e1f520ad0d6c03a92ad"
Last-Modified: Mon, 20 Feb 2023 09:32:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B3DB0684E039
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676801713#1186412/gid:0/gname:root/mode:33188/mtime:1659086506#449908000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-29T09:21:46.449908Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/bb.js
200 OK 639 B URL GET HTTP/1.1 teenfinder.online/media/bb.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (639), with no line terminators
Hash 0d553e4bac91c74bfee2dbabba61e99e
5af71e2377c9c012a7826a695f2724901941b19b
1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/bb.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 639
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "0d553e4bac91c74bfee2dbabba61e99e"
Last-Modified: Mon, 20 Feb 2023 09:29:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4194DA5CE9A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676832256#258761277/gid:0/gname:root/mode:33188/mtime:1659030913#852764000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-28T17:55:13.852764Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/exit-new/exit1.js
200 OK 3.5 kB URL GET HTTP/1.1 teenfinder.online/media/exit-new/exit1.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (641), with CRLF line terminators
Hash 625e5e2950612f771e246beb33c9ea61
e4fc251c6c000496c285f8dc3fa097040b031681
618f345a156a0eda55177a1bf0e8a414104f9b6c6ff5cdbe71966f081ccb8a46
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/exit-new/exit1.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 3473
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "625e5e2950612f771e246beb33c9ea61"
Last-Modified: Mon, 20 Feb 2023 09:32:43 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B41B09977660
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385544#182688000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:19:04.182688Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/js/jquery.js
200 OK 93 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/js/jquery.js
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type ASCII text, with very long lines (32072)
Hash df6173bad69801a82b84701789ab16c5
94908755cae039762ad53086b858eac553e3f56e
cd8f413e39247d48ea354b8fb11c227e72f641403bd8d4dd81cd7473d60daafb
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/js/jquery.js HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:26 GMT
Content-Type: application/javascript
Content-Length: 93064
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "df6173bad69801a82b84701789ab16c5"
Last-Modified: Mon, 20 Feb 2023 09:32:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4DC03F459A3
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676801713#1186412/gid:0/gname:root/mode:33188/mtime:1659086505#825907000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-29T09:21:45.825907Z
Expires: Thu, 08 Aug 2024 11:55:26 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/images/logo-loveme_white1.svg
200 OK 4.6 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/images/logo-loveme_white1.svg
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash 896592d7f2fa3d761c0b767e9399b010
ed1c0502263392938f4cbdd72afb1a8704bf840e
3417f549b6a1018ee687dd84aec136cb7fba2bb5b4c83cf269f9f8e958cc48de
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/images/logo-loveme_white1.svg HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: image/svg+xml
Content-Length: 4564
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "896592d7f2fa3d761c0b767e9399b010"
Last-Modified: Mon, 20 Feb 2023 09:32:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B41FDB05D18A
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#463665375/gid:0/gname:root/mode:33188/mtime:1655387527#38754000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:52:07.038754Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/fonts/5c92d5d3e39a260d5dd06ced7eca070d.woff2
200 OK 22 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/fonts/5c92d5d3e39a260d5dd06ced7eca070d.woff2
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type Web Open Font Format (Version 2), TrueType, length 22284, version 3.786\012- data
Hash 5c92d5d3e39a260d5dd06ced7eca070d
64df09fd462e6bb76890b7782578777b901f2003
2a99c11dd137ef8b515b3a95d2bdb38ec99bf745b2865196aa910628bcb144b9
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/fonts/5c92d5d3e39a260d5dd06ced7eca070d.woff2 HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/media/dating/sinderv2/css/style.css
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: font/woff2
Content-Length: 22284
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "5c92d5d3e39a260d5dd06ced7eca070d"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4C4D4CF33DE
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#426591579/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.426591579Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/fonts/b796339b324ec08006ca04dca90284cf.woff2
200 OK 22 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/fonts/b796339b324ec08006ca04dca90284cf.woff2
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type Web Open Font Format (Version 2), TrueType, length 21796, version 3.786\012- data
Hash b796339b324ec08006ca04dca90284cf
4283d779705f09e68939572df76c52cb41a3ec68
d65bbca022f8953936d6e60b9a59fc27f9bfd74ba96257ffe14df83b3d8eb0e3
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/fonts/b796339b324ec08006ca04dca90284cf.woff2 HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/media/dating/sinderv2/css/style.css
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: font/woff2
Content-Length: 21796
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "b796339b324ec08006ca04dca90284cf"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4C4D4DF8ABD
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#426591579/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.426591579Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/fonts/bcf3bb1b7f7a3436181788e748bae013.woff2
200 OK 15 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/fonts/bcf3bb1b7f7a3436181788e748bae013.woff2
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type Web Open Font Format (Version 2), TrueType, length 14772, version 3.327\012- data
Hash bcf3bb1b7f7a3436181788e748bae013
8ee24d38f618f070a43619f1d471d90f17d666f1
42e50c76c1bf569cb8b597ffc8cdd18a6f4a311832f46fdc1489145027550781
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/fonts/bcf3bb1b7f7a3436181788e748bae013.woff2 HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/media/dating/sinderv2/css/style.css
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: font/woff2
Content-Length: 14772
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "bcf3bb1b7f7a3436181788e748bae013"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4C4D4D39F15
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#426591579/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.426591579Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/util/flag-icon/flags/4x3/no.svg
200 OK 331 B URL GET HTTP/1.1 teenfinder.online/util/flag-icon/flags/4x3/no.svg
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type SVG Scalable Vector Graphics image\012- , ASCII text, with CRLF line terminators
Hash c7ecfe59439b5fd23924fd206cf2fded
056fbd2b17c7f08bfb480d21973a96bf86fbd72a
4027f3320608508754640a6de4cb1cdabdef4654b5a214e875c134802345683f
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /util/flag-icon/flags/4x3/no.svg HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/util/flag-icon/css/flag-icon.css
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: image/svg+xml
Content-Length: 331
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "c7ecfe59439b5fd23924fd206cf2fded"
Last-Modified: Mon, 20 Feb 2023 09:36:40 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4FB78B30496
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676841679#849157974/gid:0/gname:root/mode:33188/mtime:1655386305#848080000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:31:45.84808Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/images/scandinavia25.jpg
200 OK 131 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/images/scandinavia25.jpg
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type JPEG image data, JFIF standard 1.02, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2018:12:04 12:41:02], baseline, precision 8, 1980x1080, components 3\012- data
Size 131 kB (130919 bytes)
Hash b43a0c525444d73171788f59be0179ac
ae4bc4daef2fcf28286a139ee5f40f7965c85ee3
cedab3477ba5b9dbdd7dcccb3209185508470f466bfd18d3a8c499052b312e38
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/images/scandinavia25.jpg HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: image/jpeg
Content-Length: 130919
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "b43a0c525444d73171788f59be0179ac"
Last-Modified: Mon, 20 Feb 2023 09:32:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4EC91E82A5B
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#439665338/gid:0/gname:root/mode:33279/mtime:1655387456#282591248/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.282591248Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
teenfinder.online/media/dating/sinderv2/fonts/2e5fca371696cab9fb5a9fe214c1319c.woff2
200 OK 22 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/fonts/2e5fca371696cab9fb5a9fe214c1319c.woff2
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type Web Open Font Format (Version 2), TrueType, length 21908, version 3.786\012- data
Hash 2e5fca371696cab9fb5a9fe214c1319c
4bd3fe039b2f65d10d1b8c1b30c7962bdc313b7a
f8b1a05998ba7e93e5c9f41b004496a3576b8d10d9fafc2f7014894ebc3e72e9
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/fonts/2e5fca371696cab9fb5a9fe214c1319c.woff2 HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/media/dating/sinderv2/css/style.css
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: font/woff2
Content-Length: 21908
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "2e5fca371696cab9fb5a9fe214c1319c"
Last-Modified: Mon, 20 Feb 2023 09:32:03 GMT
No-Gzip-Compression: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B4FB78877499
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#347665198/gid:0/gname:root/mode:33279/mtime:1655387456#426591579/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.426591579Z
Expires: Thu, 08 Aug 2024 11:55:27 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
data-jsext.com/ExtService.svc/getextparams
200 OK 535 B URL GET HTTP/1.1 data-jsext.com/ExtService.svc/getextparams
IP
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectdata-jsext.com
FingerprintDA:CB:48:DC:A5:A3:8B:37:4E:46:3A:45:27:77:C5:3D:45:FA:16:AA
ValiditySun, 25 Jun 2023 18:52:48 GMT - Sat, 23 Sep 2023 18:52:47 GMT
File type JSON data\012- , Unicode text, UTF-8 text, with very long lines (492), with no line terminators
Hash 586e897213da74fd5090c0bf07dac825
45067708a3198541608d6407f76125ba4a6025d4
1c7bc89cc4f1804392e49795c3fc7835053fa989fc12b0685ab76fa477b71ec9
GET /ExtService.svc/getextparams HTTP/1.1
Host: data-jsext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://teenfinder.online
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 535
Connection: keep-alive
Access-Control-Allow-Origin: *
teenfinder.online/favicon.ico
204 No Content 0 B URL GET HTTP/1.1 teenfinder.online/favicon.ico
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Server: nginx
Date: Wed, 09 Aug 2023 11:55:27 GMT
Connection: keep-alive
Cache-Control: no-transform
teenfinder.online/media/dating/sinderv2/images/scandinavia9.jpg
200 OK 142 kB URL GET HTTP/1.1 teenfinder.online/media/dating/sinderv2/images/scandinavia9.jpg
IP
ASN #6898 SERVER.swiss Sagl
Requested by https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Certificate IssuerLet's Encrypt
Subjectteenfinder.online
FingerprintA9:F0:6C:25:7A:64:A5:74:25:B6:57:C9:D2:48:E9:32:58:CA:F4:00
ValiditySun, 23 Jul 2023 23:05:54 GMT - Sat, 21 Oct 2023 23:05:53 GMT
File type JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS3 Windows, datetime=2018:12:04 11:12:47], baseline, precision 8, 1980x1080, components 3\012- data
Size 142 kB (141621 bytes)
Hash f16004903b5d570ad959a2c9056ce64f
b5fa2860520973cdd38a6720714688f97697444d
17e63bd141a2a4195e11fd2b2c50d6af70b19b28c9e29bce869c02859dfc76ed
Analyzer Verdict Alert quad9 malicious Sinkholed
GET /media/dating/sinderv2/images/scandinavia9.jpg HTTP/1.1
Host: teenfinder.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://teenfinder.online/?u=7pfk605&o=e9ym176&cid=6f2cfa9d77c73af6e7cd41fe170ea6e9-11246-0809
Cookie: sid=t6~w0gye5yc1f35w5io1rs4mnux
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 09 Aug 2023 11:55:32 GMT
Content-Type: image/jpeg
Content-Length: 141621
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f16004903b5d570ad959a2c9056ce64f"
Last-Modified: Mon, 20 Feb 2023 09:32:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1779B46F15D46B5E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843335#447665351/gid:0/gname:root/mode:33279/mtime:1655387456#354591413/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:56.354591413Z
Expires: Thu, 08 Aug 2024 11:55:32 GMT
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
103.224.182.253
76.223.26.96
20.113.67.50
185.155.184.231
54.37.5.177