| 6oszwqmr.xyz/js/dnsads.js?dfp=1&ad_code=2&adsrc=3 |  104.21.29.123 | 200 OK | 38 B |
URL GET HTTP/36oszwqmr.xyz/js/dnsads.js?dfp=1&ad_code=2&adsrc=3 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeASCII text, with CRLF line terminators Hash99eccae6afa72c589ae54b5c3890282a 0f102f8f5b556635de65d16cf70fa8269c6761b4 b74a58316385de04b054737776e71c160cd60d2d01b5440b32c21651fb0ab8d3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/dnsads.js?dfp=1&ad_code=2&adsrc=3 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
content-length: 38
last-modified: Mon, 13 Sep 2021 15:50:14 GMT
etag: "613f7336-26"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKX9gORwmhd%2BqwJ0eqqQTZcwiqQfbbRHyq1Hl2y1Snuc1nbheivWr0Pl4o81h8SJTfQjfDHry97RSvJTzBbW0dHpqVmh569nN5lAUNfSEO67X0ebdAig5PpIlXTvrxg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd9ce256c0-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=27&recv=15&lost=0&retrans=0&sent_bytes=16149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=181&x=1", cfExtPri, cfHdrFlush;dur=44
|
|
| videothumbs.me/72p1shtbayoc.jpg |  188.114.96.1 | 200 OK | 20 kB |
URL GET HTTP/2videothumbs.me/72p1shtbayoc.jpg IP188.114.96.1:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subjectvideothumbs.me FingerprintC1:4F:45:F9:18:0B:29:97:8B:ED:6F:9D:8C:05:3F:CB:88:3E:D2:BF ValidityWed, 18 Sep 2024 10:33:09 GMT - Tue, 17 Dec 2024 10:33:08 GMT
File typeJPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc59.32.100", baseline, precision 8, 720x405, components 3 Hash7b4fdb2be99bb03b4e17fb61f9efcadb b8870b9b6e2642e8ab1f54f0ba4e0b7b921dc3e4 aedd2d86853aa7c2c9151e835772cc65f20c646ea8180c61579d5bf5c1f3bf68
GET /72p1shtbayoc.jpg HTTP/1.1
Host: videothumbs.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 28 Oct 2024 05:30:40 GMT
content-type: image/jpeg
content-length: 20052
last-modified: Thu, 13 Apr 2023 04:04:04 GMT
etag: "64377f34-4e54"
expires: Mon, 04 Nov 2024 00:51:13 GMT
cache-control: max-age=31536000
cf-cache-status: HIT
age: 71371
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TG3G0MVujRJCYIMYDPAhgkuZ1nUhhrFJ04t47UoZV0Em%2F87FLIylB478Y7P896T578eulyq1XpzvIFwE4vAs9pu5Q8ZqKK4CpmmCKRxDmi0d1yUsWSvJI4oUZ1AjBsRHBg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9889021868b521-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16538&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3208&recv_bytes=1045&delivery_rate=260932&cwnd=252&unsent_bytes=0&cid=495d28f492c5e71a&ts=45&x=0"
X-Firefox-Spdy: h2
|
|
| be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/master.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= |  91.211.89.136 | 200 OK | 301 B |
URL GET HTTP/1.1be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/master.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= IP91.211.89.136:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectbe2719.rcr22.ams01.cdn112.com FingerprintAD:AD:6E:06:29:22:3F:58:96:5F:71:98:66:48:8D:A4:18:E3:98:B8 ValidityTue, 24 Sep 2024 19:53:21 GMT - Mon, 23 Dec 2024 19:53:20 GMT
Hash80a87cac068656b19a67a3463da10ae6 dd14759d278be43395ed3383da6d07aa0f2ef966 44f6eea579417875c46907d9600261b45e0ad7ae419b6704a258dbaef88e54ad
GET /hls2/01/03483/qqsl86ogy3f6_x/master.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= HTTP/1.1
Host: be2719.rcr22.ams01.cdn112.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://6oszwqmr.xyz
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Oct 2024 05:30:40 GMT
Content-Type: application/vnd.apple.mpegurl
Last-Modified: Mon, 28 Oct 2024 05:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 29 Oct 2024 02:18:46 GMT
Access-Control-Allow-Origin: *
Cache-Control: max-age=259200, no-store, no-cache
Sprint-Cache: HIT
Content-Encoding: gzip
|
|
| be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/index-v1-a1.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= | 91.211.89.136 | 200 OK | 1.2 kB |
URL GET HTTP/1.1be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/index-v1-a1.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= IP91.211.89.136:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectbe2719.rcr22.ams01.cdn112.com FingerprintAD:AD:6E:06:29:22:3F:58:96:5F:71:98:66:48:8D:A4:18:E3:98:B8 ValidityTue, 24 Sep 2024 19:53:21 GMT - Mon, 23 Dec 2024 19:53:20 GMT
Hasheb70f087cb30ed4e9d74048c5523008d 488e65e6fc1535a5674605c418a7c3e513a1bddc 18f5964106c365dbe53ece3d627f1356a03a3fc19c32a5747f5a3631fcd690fb
GET /hls2/01/03483/qqsl86ogy3f6_x/index-v1-a1.m3u8?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= HTTP/1.1
Host: be2719.rcr22.ams01.cdn112.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://6oszwqmr.xyz
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Oct 2024 05:30:40 GMT
Content-Type: application/vnd.apple.mpegurl
Last-Modified: Mon, 28 Oct 2024 05:30:40 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 29 Oct 2024 02:18:46 GMT
Access-Control-Allow-Origin: *
Cache-Control: max-age=259200, no-store, no-cache
Sprint-Cache: HIT
Content-Encoding: gzip
|
|
| be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/encryption.key?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= | 91.211.89.136 | 200 OK | 16 B |
URL GET HTTP/1.1be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/encryption.key?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= IP91.211.89.136:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectbe2719.rcr22.ams01.cdn112.com FingerprintAD:AD:6E:06:29:22:3F:58:96:5F:71:98:66:48:8D:A4:18:E3:98:B8 ValidityTue, 24 Sep 2024 19:53:21 GMT - Mon, 23 Dec 2024 19:53:20 GMT
Hash7ed3ac6fa3c20bb70821ff5edecb83c8 150c18fd11b0ed2e86dfbe7258b6ce91ff397d51 d8892aa97c36d101ed22ebc31df175fb339e9385ebe9e768d907ae81fc66a474
GET /hls2/01/03483/qqsl86ogy3f6_x/encryption.key?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= HTTP/1.1
Host: be2719.rcr22.ams01.cdn112.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://6oszwqmr.xyz
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Oct 2024 05:30:40 GMT
Content-Type: application/octet-stream
Content-Length: 16
Connection: keep-alive
Last-Modified: Sun, 19 Nov 2000 08:52:00 GMT
Expires: Tue, 29 Oct 2024 01:03:49 GMT
ETag: "5f693e80-10"
Access-Control-Allow-Origin: *
Cache-Control: max-age=259200, no-store, no-cache
Sprint-Cache: HIT
Accept-Ranges: bytes
|
|
| 6oszwqmr.xyz/favicon.ico | 104.21.29.123 | 200 OK | 5.0 kB |
IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hashf7b404d04734d64575f577b506c22a06 485d344ea5ace3529dd472f3fadaa621f046eaf5 c53b6a1e519b835191c058325f17d0f3ea15e1507ca47313c94cc54b68741500
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:40 GMT
content-type: image/x-icon
last-modified: Mon, 02 Feb 2015 19:26:28 GMT
etag: W/"54cfcf64-47e"
expires: Mon, 04 Nov 2024 00:15:40 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 18900
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tz3D6M0w9PzvSUZ7%2Bm2IMy4TskRWZqjS3o9JPTnr2HB%2F3jfl%2FCiT8XeK7RtBMtDS0i%2BBLJ44MWPnnbNrgpOm%2Bs%2FbXBqe6cj2OzqKRHhr5EoiKSMfQNvkXoUCMGtjIl4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9889005fcd56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=20100&sent=333&recv=32&lost=0&retrans=0&sent_bytes=369493&recv_bytes=5189&delivery_rate=3416630&cwnd=187200&unsent_bytes=0&cid=dc40a57a2fb08041&ts=619&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| 6oszwqmr.xyz/js/bafsd.js | 104.21.29.123 | 200 OK | 10 kB |
IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with CRLF line terminators Hashc2432aca90e92e0370d2ded2545eb1fa 8f1ae40f7dc9c4ccfcb91d04530a1f072e9d06eb 89c40275bddb7257d519bda010de1c4df70a30b5f84be325f2ae53168f276cb5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/bafsd.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 04 Oct 2024 05:52:43 GMT
etag: W/"66ff82ab-358a"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DAn76AnHb%2Bc2MHL3iRSIvlv5EQicSDHBfV3H39sEEV80tPIccNxwxoL5YerBs7kEeId80bbty6Bpn6WDFBJYGeqL6fIijZeB8LRJ%2FTL3g94VXAB5GULZRagqHiiMm5g%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd9cdd56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=27&recv=15&lost=0&retrans=0&sent_bytes=16149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=177&x=1", cfExtPri, cfHdrFlush;dur=13
|
|
| be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/seg-1-v1-a1.ts?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= | 91.211.89.136 | 200 OK | 1.6 MB |
URL GET HTTP/1.1be2719.rcr22.ams01.cdn112.com/hls2/01/03483/qqsl86ogy3f6_x/seg-1-v1-a1.ts?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= IP91.211.89.136:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectbe2719.rcr22.ams01.cdn112.com FingerprintAD:AD:6E:06:29:22:3F:58:96:5F:71:98:66:48:8D:A4:18:E3:98:B8 ValidityTue, 24 Sep 2024 19:53:21 GMT - Mon, 23 Dec 2024 19:53:20 GMT
Size1.6 MB (1582592 bytes) Hash40cae0a517cd58cf409d12e2253d3b69 2eb0583284048da6945e1ac72fb87b58af0cb1fd eacc8ce6db769b60d022d45749508762d65b9d618bff953bdd197f123eac0ff6
GET /hls2/01/03483/qqsl86ogy3f6_x/seg-1-v1-a1.ts?t=fC8bbRW2zcI3kmsu8x9egdUT5gq9v9RbIOK5HwFNM1Y&s=1730093439&e=10800&f=25082241&srv=25&asn=50304&sp=5500&p= HTTP/1.1
Host: be2719.rcr22.ams01.cdn112.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://6oszwqmr.xyz
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 28 Oct 2024 05:30:40 GMT
Content-Type: video/MP2T
Content-Length: 1582592
Connection: keep-alive
Last-Modified: Sun, 19 Nov 2000 08:52:00 GMT
Expires: Tue, 29 Oct 2024 01:03:49 GMT
ETag: "5f693e80-182600"
Access-Control-Allow-Origin: *
Cache-Control: max-age=259200, no-store, no-cache
Sprint-Cache: HIT
Accept-Ranges: bytes
|
|
| 6oszwqmr.xyz/adcgi?id=80557588 | 104.21.29.123 | 504 Gateway Timeout | 6.3 kB |
URL GET HTTP/36oszwqmr.xyz/adcgi?id=80557588 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeHTML document, ASCII text, with very long lines (394) Hash65e2eae683515386ddc9a0ba0432befe 61fe15d54776a52110f4d44d27de56cb9b5138ec 08631330bf3038ba13d1fca0aeac3d31a1792bbcec8d1e200f3c1ee21acdce6b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /adcgi?id=80557588 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 504 Gateway Timeout
date: Mon, 28 Oct 2024 05:30:41 GMT
content-type: text/html; charset=UTF-8
content-length: 6323
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=imZGmhsL3jXiJaxrl6dJ3q2hEHVfySEVpZu2v4cGMYDuHjTeunbWWGdcigwG1GuaQV5C3FWt8iiF4hU%2F7UE330ReYYklepWdV1wjigU7491JPWfYVVpZrKAmEZ2N0YQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
server: cloudflare
cf-ray: 8d9889054d6356c0-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22204&sent=335&recv=34&lost=0&retrans=0&sent_bytes=370595&recv_bytes=5507&delivery_rate=22509&cwnd=187200&unsent_bytes=0&cid=dc40a57a2fb08041&ts=1570&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| uqqmj868.xyz/ | 188.114.96.1 | 302 Found | 0 B |
IP188.114.96.1:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subjectuqqmj868.xyz Fingerprint80:B4:6F:5F:E3:AB:82:94:A6:D1:DE:33:8A:98:26:6B:A3:88:64:8D ValidityTue, 24 Sep 2024 06:01:54 GMT - Mon, 23 Dec 2024 06:01:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: uqqmj868.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Mon, 28 Oct 2024 05:30:49 GMT
content-type: text/html; charset=UTF-8
location: https://epededonemile.com/?fmon=1100125
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0J5CkOnn4NowPBZ1Ea5VBBZekb2TUVfH5SV28dEpnTiyE6blNuZs4b8OObtwxN5pRFqCsMfhJsL4se7iSvyVpnlt9nR1Z2SoqciBIJT2Z6QS55WXzQtVmWZWOIKqchQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8d98893a1958b4f9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16515&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3204&recv_bytes=1133&delivery_rate=261230&cwnd=253&unsent_bytes=0&cid=3bb65696cc57e1b9&ts=68&x=0"
X-Firefox-Spdy: h2
|
|
| xml-v4.tri.media/click?i=1CiyxNEEzHs_0 |  174.137.133.17 | 302 Found | 0 B |
URL GET HTTP/1.1xml-v4.tri.media/click?i=1CiyxNEEzHs_0 IP174.137.133.17:443 ASN#27257 WEBAIR-INTERNET
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGlobalSign nv-sa Subject*.tri.media Fingerprint3B:55:03:D9:CD:36:CE:5A:84:0F:A1:18:02:6B:14:6E:91:4A:CC:1D ValidityThu, 19 Sep 2024 06:51:24 GMT - Tue, 21 Oct 2025 06:51:23 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?i=1CiyxNEEzHs_0 HTTP/1.1
Host: xml-v4.tri.media
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://6oszwqmr.xyz/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Mon, 28 Oct 2024 05:30:50 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store
Location: https://mybiddd.com/in/p/?spot_id=2004558&cat=25&sub_id=507232629
|
|
| 6oszwqmr.xyz/assets/css/jw8-theme.css?v=3.0.6 | 104.21.29.123 | 200 OK | 10 kB |
URL GET HTTP/36oszwqmr.xyz/assets/css/jw8-theme.css?v=3.0.6 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeASCII text, with very long lines (938), with CRLF line terminators Hash218f1af32c959506efe281f39309d9a5 948fbcdba4275e13fc3e469a04df2d727aabdf4a 5425c5e4dfa36e386ee465a9fe20f61290bcd377fe3fd950164c5c6e16301593
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /assets/css/jw8-theme.css?v=3.0.6 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: text/css
last-modified: Wed, 03 Apr 2024 15:50:39 GMT
etag: W/"660d7acf-62a2"
expires: Thu, 31 Oct 2024 00:03:57 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 365202
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kc2e%2BOLdZq8Nyz3io4iYD2PYx8%2FzmNl2dEuwxtNHFEJHRdsL%2BJWSNHtibd1XEr9n1h4qChLdCH%2B9T7E796GABtNOW%2BIFoIBUUjiMxccaVeUhOz0tMIzjqQe88%2FLs9k0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888ffef6656c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21298&sent=140&recv=27&lost=0&retrans=0&sent_bytes=141662&recv_bytes=4705&delivery_rate=850336&cwnd=93600&unsent_bytes=0&cid=dc40a57a2fb08041&ts=546&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| mybiddd.com/popunder/in/click/?mid=3988119599313852734&pid=0&site=&sc=NO&usage_type=DCH&subid=507232629&sid=0&cid=0&price=0&is_cpm=1&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=6oszwqmr.xyz&hostname=auc-popunder-hz-2&site_id=0&spot_id=2004558&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB25&min_cpm=0.035&placement_type_id=7&skin_test=&verify_hash=b8c407a673f708e814f365357ec07d85&score=515.0593812327122&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=0&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB25&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.035&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26site_id%3D%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D%26spot_id%3D2004558%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252F6oszwqmr.xyz%252F%26sid%3D0%26katds_labels%3D%26is_iframe%3D1%26btype%3D0%26score%3D515.0593812327122%26bf%3D0.035%26iabcat%3DIAB25%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=2&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=&auction_time=1730093450&is_in_app=0&delivery_method=js_redirect&user_keywords=&keywords= |  94.130.197.239 | 302 Found | 0 B |
URL GET HTTP/2mybiddd.com/popunder/in/click/?mid=3988119599313852734&pid=0&site=&sc=NO&usage_type=DCH&subid=507232629&sid=0&cid=0&price=0&is_cpm=1&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=6oszwqmr.xyz&hostname=auc-popunder-hz-2&site_id=0&spot_id=2004558&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB25&min_cpm=0.035&placement_type_id=7&skin_test=&verify_hash=b8c407a673f708e814f365357ec07d85&score=515.0593812327122&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=0&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB25&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.035&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26site_id%3D%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D%26spot_id%3D2004558%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252F6oszwqmr.xyz%252F%26sid%3D0%26katds_labels%3D%26is_iframe%3D1%26btype%3D0%26score%3D515.0593812327122%26bf%3D0.035%26iabcat%3DIAB25%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=2&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=&auction_time=1730093450&is_in_app=0&delivery_method=js_redirect&user_keywords=&keywords= IP94.130.197.239:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectpopunder.infrapu.sh FingerprintFD:84:64:F6:1B:6A:2F:EA:21:1E:A5:B8:52:65:15:AA:05:00:21:48 ValidityWed, 09 Oct 2024 12:06:27 GMT - Tue, 07 Jan 2025 12:06:26 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /popunder/in/click/?mid=3988119599313852734&pid=0&site=&sc=NO&usage_type=DCH&subid=507232629&sid=0&cid=0&price=0&is_cpm=1&cpm=0&ecpm=0&crid=&crtid=&tcid=0&out_id=&ver=&ver_c=&refdom=6oszwqmr.xyz&hostname=auc-popunder-hz-2&site_id=0&spot_id=2004558&utm_source=&utm_medium=&utm_campaign=&utm_content=&expiration_timestamp=0&created_at=0000-00-00&is_native=0&burl=&pop_winurl=&ip=91.90.42.154&testab=&px_id=0&adblock=0&auction_host=&mm=&yc=&render_type=&campaign_type=&uniq=&exp=0&resp_type=&iabcat=IAB25&min_cpm=0.035&placement_type_id=7&skin_test=&verify_hash=b8c407a673f708e814f365357ec07d85&score=515.0593812327122&durl=&ml=&tag_ab=&original_bid=0&user_fp=0&v2=0&pop_type=0&space_id=0&real_bid=&skin_id=&vertical_id=&stratagem=&accel=0&gyr=0&iabcat=IAB25&ip_mismatch=false&ua_mismatch=false&ssp=3758&rc=0&v2_track=0&otype=0&mn=0&priority=0&bb=0.035&url=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26site_id%3D%26utm1%3D%26utm2%3D%26utm3%3D%26utm4%3D%26idzone%3D%26spot_id%3D2004558%26mo%3D%26ve%3D%26ad_tags%3D%26p%3Dhttps%253A%252F%252F6oszwqmr.xyz%252F%26sid%3D0%26katds_labels%3D%26is_iframe%3D1%26btype%3D0%26score%3D515.0593812327122%26bf%3D0.035%26iabcat%3DIAB25%26allowed_labels%3D&pr=&bid_crid=&bid_cid=&ad_tags=&is_interstitial=0&is_direct=2&label_ids=&site_id64=&sp_cl=0&act_sess=0&sp_scr=0&intes=&izb=&ang=0&act_su=0&interest_vertical_ids=&v_scroll_freq=&time_sess=&ext_campaign_id=&scroll_percent=0&empty_clicks=0&aid=0&high_freq_clicks=0&dev_console_activity=0&topics=&client_price=0&direct_client_price=0&o_d=&is_webview=0&timezone_olson=&timezone_ip=Europe/Oslo&offer_label_ids=&client_payment_model=&auction_time=1730093450&is_in_app=0&delivery_method=js_redirect&user_keywords=&keywords= HTTP/1.1
Host: mybiddd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mybiddd.com/in/p/?spot_id=2004558&cat=25&sub_id=507232629
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
server: nginx/1.16.0
date: Mon, 28 Oct 2024 05:30:50 GMT
content-length: 0
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
location: https://popdemission.com/in/849/?source=507232629&site_id=&utm1=&utm2=&utm3=&utm4=&idzone=&spot_id=2004558&mo=&ve=&ad_tags=&p=https%3A%2F%2F6oszwqmr.xyz%2F&sid=0&katds_labels=&is_iframe=1&btype=0&score=515.0593812327122&bf=0.035&iabcat=IAB25&allowed_labels=
X-Firefox-Spdy: h2
|
|
| popdemission.com/in/849/?source=507232629&site_id=&utm1=&utm2=&utm3=&utm4=&idzone=&spot_id=2004558&mo=&ve=&ad_tags=&p=https%3A%2F%2F6oszwqmr.xyz%2F&sid=0&katds_labels=&is_iframe=1&btype=0&score=515.0593812327122&bf=0.035&iabcat=IAB25&allowed_labels= | 62.122.168.42 | 302 Found | 0 B |
URL GET HTTP/2popdemission.com/in/849/?source=507232629&site_id=&utm1=&utm2=&utm3=&utm4=&idzone=&spot_id=2004558&mo=&ve=&ad_tags=&p=https%3A%2F%2F6oszwqmr.xyz%2F&sid=0&katds_labels=&is_iframe=1&btype=0&score=515.0593812327122&bf=0.035&iabcat=IAB25&allowed_labels= IP62.122.168.42:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectpopdemission.com Fingerprint80:2C:31:34:88:87:CF:EE:D8:90:3E:88:52:D7:C6:D2:DB:BB:9F:D1 ValidityMon, 07 Oct 2024 03:17:08 GMT - Sun, 05 Jan 2025 03:17:07 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/849/?source=507232629&site_id=&utm1=&utm2=&utm3=&utm4=&idzone=&spot_id=2004558&mo=&ve=&ad_tags=&p=https%3A%2F%2F6oszwqmr.xyz%2F&sid=0&katds_labels=&is_iframe=1&btype=0&score=515.0593812327122&bf=0.035&iabcat=IAB25&allowed_labels= HTTP/1.1
Host: popdemission.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mybiddd.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx/1.20.1
date: Mon, 28 Oct 2024 05:30:51 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://kaminari.systems/v1/click?kmnrKey=891498445&sub1=2004558&u=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26spot_id%3D299762%26p%3Dhttps%253A%252F%252Fgloporn.com%252F
pragma: no-cache
vary: *
cache-control: no-cache, no-store, must-revalidate
set-cookie: 849.0=1; expires=Tue, 29 Oct 2024 05:30:50 GMT; path=/; secure; SameSite=None
X-Firefox-Spdy: h2
|
|
| kaminari.systems/v1/click?kmnrKey=891498445&sub1=2004558&u=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26spot_id%3D299762%26p%3Dhttps%253A%252F%252Fgloporn.com%252F | 31.220.27.154 | 200 OK | 50 kB |
URL GET HTTP/2kaminari.systems/v1/click?kmnrKey=891498445&sub1=2004558&u=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26spot_id%3D299762%26p%3Dhttps%253A%252F%252Fgloporn.com%252F IP31.220.27.154:443 ASN#39572 DataWeb Global Group B.V.
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectkaminari.systems FingerprintEF:8F:6F:19:DA:58:76:ED:5D:28:D1:C8:BC:2E:E5:DE:3C:D1:B5:5E ValidityThu, 10 Oct 2024 10:55:28 GMT - Wed, 08 Jan 2025 10:55:27 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v1/click?kmnrKey=891498445&sub1=2004558&u=https%3A%2F%2Fpopdemission.com%2Fin%2F849%2F%3Fsource%3D507232629%26spot_id%3D299762%26p%3Dhttps%253A%252F%252Fgloporn.com%252F HTTP/1.1
Host: kaminari.systems
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mybiddd.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 28 Oct 2024 05:30:51 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
accept-ch: Width, Viewport-Width, DPR, Device-Memory, Downlink, RTT, ECT, Save-Data, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
access-control-allow-headers: X-Requested-With, Cache-Control, Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| epededonemile.com/?fmon=1100125 | 108.157.229.107 | 302 Found | 1.9 kB |
URL GET HTTP/2epededonemile.com/?fmon=1100125 IP108.157.229.107:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerAmazon Subjectepededonemile.com Fingerprint46:83:A9:71:37:5C:CA:E8:CC:04:0A:4C:B6:4D:C4:FF:85:97:F1:1B ValidityTue, 08 Oct 2024 00:00:00 GMT - Thu, 06 Nov 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?fmon=1100125 HTTP/1.1
Host: epededonemile.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://6oszwqmr.xyz/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: text/plain
content-length: 0
location: https://xml-v4.tri.media/click?i=1CiyxNEEzHs_0
date: Mon, 28 Oct 2024 05:30:49 GMT
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
set-cookie: csu=62c4e097-a5dd-42f0-82a3-6199e5999a66
x-cache: Miss from cloudfront
via: 1.1 17c1b187a3afe016510e55151109cc30.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P2
x-amz-cf-id: UGG25Ft-xVhjMBXXlKXWkEyVYwpXYAhNRs8YbU3SBJV2g25rwgB-bg==
X-Firefox-Spdy: h2
|
|
| 6oszwqmr.xyz/css/main.css?v=4 | 104.21.29.123 | 200 OK | 49 kB |
URL GET HTTP/36oszwqmr.xyz/css/main.css?v=4 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /css/main.css?v=4 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: text/css
last-modified: Thu, 26 Sep 2024 18:06:54 GMT
etag: W/"66f5a2be-c03c"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f0uDA%2FFekphBV7QQjWzr7f4FIv9ARpZonfXIgQKn9aDOvgtIpdcukEI0KzbYn5Bx7F%2FfUp4jWxQLh%2Fn73T%2FyZFvfF7vIbGmq7c22ROMeH8jAj6UePiWnUruiBESxXT0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd8cca56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=22&recv=15&lost=0&retrans=0&sent_bytes=10666&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=171&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ieyri61b.xyz/js/dwarf.js | 172.67.207.46 | 200 OK | 71 kB |
IP172.67.207.46:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subjectieyri61b.xyz Fingerprint7C:03:59:1C:CB:57:4A:11:C0:F0:35:06:50:5D:94:B0:83:E1:C7:6A ValiditySun, 29 Sep 2024 09:41:52 GMT - Sat, 28 Dec 2024 09:41:51 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash645c49c2f4d766a0f53aebc6f39c84be 2cf649c9048d567904389d8032e28f9b82e688f8 637717a3de6b2f9043510f3c9df0ea404eee6df9d6c99a528b4603c590858811
GET /js/dwarf.js HTTP/1.1
Host: ieyri61b.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript
last-modified: Tue, 08 Oct 2024 07:44:38 GMT
etag: W/"6704e2e6-1154e"
cache-control: max-age=14400
cf-cache-status: HIT
age: 2381
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LwNTprdPpeVeBLSTnUwq0oqh6qSLYkyBeY%2BiJDObxE1PC6Gud3tacU58ujkRauUa7Qm1HjkR7L3DcvydSAdYTMswK02l68fGmSFlPrVKv4J2IyRcyPZLHHz0KVddzxk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fe4f7556a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16483&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3279&recv_bytes=1149&delivery_rate=262461&cwnd=252&unsent_bytes=0&cid=b24955fc46842ebb&ts=47&x=0"
X-Firefox-Spdy: h2
|
|
| 6oszwqmr.xyz/player/jw8_26/jwplayer.core.controls.js?v=2 | 104.21.29.123 | 200 OK | 327 kB |
URL GET HTTP/36oszwqmr.xyz/player/jw8_26/jwplayer.core.controls.js?v=2 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
Size327 kB (326903 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /player/jw8_26/jwplayer.core.controls.js?v=2 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 03 Apr 2024 09:09:34 GMT
etag: W/"660d1cce-4fcf7"
expires: Tue, 29 Oct 2024 12:34:09 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 492990
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UrELQwhUxsNDuL5k4iaJ155%2BUUXqs0LSE8Uw5OeeYCocBXPAvGf3pu%2FbVC6KMwd4%2FdBOdm55gV7r1LbPznz2MuMMqygaprlSPf%2BLRtEEz7cPweQtsHjuGVXLnOs4QYM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888ffdf6356c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21298&sent=146&recv=27&lost=0&retrans=0&sent_bytes=147828&recv_bytes=4705&delivery_rate=850336&cwnd=93600&unsent_bytes=0&cid=dc40a57a2fb08041&ts=554&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| 6oszwqmr.xyz/player/jw8_26/jwplayer.js?v=5.0.2 | 104.21.29.123 | 200 OK | 111 kB |
URL GET HTTP/36oszwqmr.xyz/player/jw8_26/jwplayer.js?v=5.0.2 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
Size111 kB (111441 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /player/jw8_26/jwplayer.js?v=5.0.2 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 05 Apr 2024 14:58:43 GMT
etag: W/"661011a3-1b351"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=il%2FE05x7Hy%2Bqbko1gqgSSO3Pbf5gmoDlf7kW6U47tW1FJCIewATbp2fYUK7ix7qxOB6EKwvhVQxGY2N%2BIIxA8T9UvchgfIb6VQHEWcO3h%2F%2BCO8t9vRWFZPtNIiiaLeA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd9ce056c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=27&recv=15&lost=0&retrans=0&sent_bytes=16149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=181&x=1", cfExtPri, cfHdrFlush;dur=9
|
|
| 6oszwqmr.xyz/player/jw8/vast.js | 104.21.29.123 | 200 OK | 107 kB |
URL GET HTTP/36oszwqmr.xyz/player/jw8/vast.js IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size107 kB (107114 bytes) Hash3cd85ca1814c3fd976764bf6b83b989d 90e931622205c6adfbc75cfe681563a127580f05 2e4fe3d8b3565a3f8b5ec0ecfe0e5f26a756401b6847dd475327793da41897f5
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /player/jw8/vast.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 08 Sep 2022 10:34:42 GMT
etag: W/"6319c542-1a26a"
expires: Thu, 31 Oct 2024 23:54:11 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 279388
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FBGWuht2kZ%2BatXng6FxamWRAOIg0QQSE8nB%2BoQPrir77NIuVj5Khlk%2BfFmVwliV0f7LxE0XoBZH0Pen6Yai7rvNEUGhmbvpKE1YOIj0Q1yQeUg%2Buh%2FbDRoTxGp0pv9M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888ff7f0156c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=20821&sent=108&recv=23&lost=0&retrans=0&sent_bytes=107935&recv_bytes=3767&delivery_rate=1172532&cwnd=93600&unsent_bytes=0&cid=dc40a57a2fb08041&ts=482&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| 6oszwqmr.xyz/player/jw8_26/provider.hlsjs.js?v=2 | 104.21.29.123 | 200 OK | 423 kB |
URL GET HTTP/36oszwqmr.xyz/player/jw8_26/provider.hlsjs.js?v=2 IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
Size423 kB (422959 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /player/jw8_26/provider.hlsjs.js?v=2 HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:40 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 05 Apr 2024 14:57:50 GMT
etag: W/"6610116e-6742f"
expires: Tue, 29 Oct 2024 12:34:09 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 492990
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HEF3lBzoysJHHtZGU%2F5Ry2TmQ1b43S5bXDLJBN%2BF6EDmHU%2FSiBiekyJqR6icL7uzmH1xv%2F1pqiw2MnwCCoOB78YEqYn7uvPGYdkJL0FcKpOyjCGmiKr8E2zw7DwrH50%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888ffef6c56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21298&sent=219&recv=27&lost=0&retrans=0&sent_bytes=235262&recv_bytes=4705&delivery_rate=850336&cwnd=93600&unsent_bytes=0&cid=dc40a57a2fb08041&ts=558&x=1", cfExtPri, cfHdrFlush;dur=6
|
|
| 6oszwqmr.xyz/js/jquery.js | 104.21.29.123 | 200 OK | 90 kB |
URL GET HTTP/36oszwqmr.xyz/js/jquery.js IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/jquery.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
etag: W/"603e8adc-15d9d"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2BvcSnEvGrEeiU2GL5CMwN4E%2BzbtLJEelabmKvr64Tj72ie0hr1bvoxrsMa0CGkkwC2CgAOAzoW%2F76QRJiwenJgfprwlcWoD8R2GMvTZHoo%2BlXDFNTMFPKwUbIMY6Ns%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd8ccd56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=27&recv=15&lost=0&retrans=0&sent_bytes=16149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=177&x=1", cfExtPri, cfHdrFlush;dur=11
|
|
| 6oszwqmr.xyz/js/jquery.cookie.js | 104.21.29.123 | 200 OK | 4.3 kB |
URL GET HTTP/36oszwqmr.xyz/js/jquery.cookie.js IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with very long lines (4427), with no line terminators Hashc8a0b7f16c38377537c6ab251cb5bc72 528e37de81abf523b92ce0b457cb593983ed347a e31179e4a4fffc7faee4f95d4f67ce056d12a57c451dee1dae3e9062b126a00e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/jquery.cookie.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 31 May 2011 12:53:56 GMT
etag: W/"4de4e4e4-10eb"
expires: Sun, 03 Nov 2024 07:11:42 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 80337
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DV2yzFF5a4DkMHaaz2M2xj%2F5FMqeXWu9zfaTgPIVKjjp4HGqkwHPeSrvzeJB17sfhCy1brgfGtqJAv6omjbaGJcITpRGwVXk1x%2FrYk0EcS56JHo%2FfvjhWeBLEGbDRg4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd8cd156c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=27&recv=15&lost=0&retrans=0&sent_bytes=16149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=176&x=1", cfExtPri, cfHdrFlush;dur=14
|
|
| 6oszwqmr.xyz/js/ls.js | 104.21.29.123 | 200 OK | 2.1 kB |
IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with very long lines (2079), with no line terminators Hash66b63b5fefbe179c0fd09e63c11b7e12 e657b7d46921bec0bcbd746339ccc03ef4690036 52eb05218aa889bcc3b78062d496c747a04db5126648bd3a57cf8c43e3039bf2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/ls.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 14 Feb 2023 11:28:54 GMT
etag: W/"63eb7076-80f"
expires: Tue, 29 Oct 2024 12:33:26 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 493033
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W8irpBUmwzMXtWzhupaBTa7U56agydm%2B1MWR1DtJxcF2kPFwaKpkvWJx8d2ULBJyRUbRfGo7Ilogm0g0w07CoCXzcfy0ITgpwIK7w466vllvumx1IbP5ozwyo8VxIds%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd8cd256c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=20&recv=15&lost=0&retrans=0&sent_bytes=9030&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=171&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| mybiddd.com/in/p/?spot_id=2004558&cat=25&sub_id=507232629 | 94.130.197.239 | 200 OK | 1.9 kB |
URL GET HTTP/2mybiddd.com/in/p/?spot_id=2004558&cat=25&sub_id=507232629 IP94.130.197.239:443 ASN#24940 Hetzner Online GmbH
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectpopunder.infrapu.sh FingerprintFD:84:64:F6:1B:6A:2F:EA:21:1E:A5:B8:52:65:15:AA:05:00:21:48 ValidityWed, 09 Oct 2024 12:06:27 GMT - Tue, 07 Jan 2025 12:06:26 GMT
File typeHTML document, ASCII text, with very long lines (1916), with no line terminators Hash02916fbf0d178377efa266f26d027e87 dbbebc4248539809d40266e8a96be9866a4dbc8f 6fd3f126251bd89274594debf63aeee520e490d7b3114b5f6b788d98a6fbd90c
GET /in/p/?spot_id=2004558&cat=25&sub_id=507232629 HTTP/1.1
Host: mybiddd.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://6oszwqmr.xyz/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.16.0
date: Mon, 28 Oct 2024 05:30:50 GMT
content-type: text/html
vary: Origin
cache-control: no-transform, no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| kts.cvastico.com/in/885/?subid=2044015014&domain=nodomain&target_id=0 | 62.122.173.28 | 200 OK | 1.2 kB |
URL GET HTTP/2kts.cvastico.com/in/885/?subid=2044015014&domain=nodomain&target_id=0 IP62.122.173.28:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectkts.cvastico.com Fingerprint76:43:00:29:CE:A6:FD:0F:74:6C:44:63:DE:72:67:0F:B9:14:94:32 ValidityMon, 07 Oct 2024 03:11:26 GMT - Sun, 05 Jan 2025 03:11:25 GMT
File typeHTML document, ASCII text, with very long lines (1227), with no line terminators Hash9d699eebc042fcdc6b1e2cdf612f7b46 3f3bd553e5d614d2641395b303db2064b8cf16c2 3cd1f2c6c1147d36768fbc8a412347d3d76fd0c4451d39ec74aadb0b8219b97d
GET /in/885/?subid=2044015014&domain=nodomain&target_id=0 HTTP/1.1
Host: kts.cvastico.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kaminari.systems/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.20.1
date: Mon, 28 Oct 2024 05:30:51 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
set-cookie: 885.0=1; expires=Tue, 29 Oct 2024 05:30:51 GMT; path=/; secure; SameSite=None
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| 6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh | 104.21.29.123 | 200 OK | 16 kB |
URL User Request GET HTTP/26oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh IP104.21.29.123:443
CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text, with very long lines (6495), with CRLF, LF line terminators Hash8ebc2093dce2ff5ada2e271396042368 ae30f2e962e0bedf1cbc52032ee2e79893c5fd00 ad15134afdd9a7568ca364eef655e2fb0e3837fad063fc8777cbf047fae8c04e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cwns/72p1shtbayoc?referer=bflix.sh HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: text/html; charset=UTF-8
expires: Sun, 27 Oct 2024 05:30:39 GMT
set-cookie: lang=1; domain=.6oszwqmr.xyz; path=/; HttpOnly
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NC0b3wOkI3lkhxu8giXYbroJ2ObJMxorrl%2Fq%2F3KMuat84zmeRLVKYSRCO%2FBUtyD9CiVGi8NqefjcIlVEc4TMAoEAFnIIXZPK4rILed93syXdpyyEsXN%2FftT336MRG0c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8d9888fb2bea7130-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=21855&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3199&recv_bytes=1141&delivery_rate=262382&cwnd=254&unsent_bytes=0&cid=cb6a4edd3f65af56&ts=234&x=0"
X-Firefox-Spdy: h2
|
|
| 6oszwqmr.xyz/js/xupload.js | 104.21.29.123 | 200 OK | 11 kB |
URL GET HTTP/36oszwqmr.xyz/js/xupload.js IP104.21.29.123:443
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerGoogle Trust Services Subject6oszwqmr.xyz Fingerprint2A:E1:7C:BD:92:46:C2:FF:11:03:8B:CC:44:03:FF:5D:95:3A:EC:0C ValidityFri, 27 Sep 2024 13:41:49 GMT - Thu, 26 Dec 2024 13:41:48 GMT
File typeJavaScript source, ASCII text Hash2609e3a9490dcfe748407d3af317c472 af55b2b16e9190e09407f67ffae4ca705ea6f112 c3c7c3de97ef15965def93fc9317e82854b979aa1a7980fde49b873a04aab85d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /js/xupload.js HTTP/1.1
Host: 6oszwqmr.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh
Cookie: lang=1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Mon, 28 Oct 2024 05:30:39 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 04 Aug 2021 13:41:52 GMT
etag: W/"610a9920-2a73"
expires: Mon, 04 Nov 2024 01:10:13 GMT
cache-control: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
age: 15626
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2BzzZPTAn0GUUdE31mfmTzn%2Fh9C4wgVJYv1LATsVTHwKaGnOP5QynfZh7mxB6Y93G04rg9bYHhQnYXZo4SbdSC4PMCgiSvWTjGGh5JIMlmgVK3KfnHQILewB%2FTqgXJU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8d9888fd8cce56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19797&sent=15&recv=15&lost=0&retrans=0&sent_bytes=4149&recv_bytes=3181&delivery_rate=2450&cwnd=12000&unsent_bytes=0&cid=dc40a57a2fb08041&ts=170&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 | 64.233.162.84 | 400 Bad Request | 0 B |
URL GET HTTP/2accounts.google.com/CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 IP64.233.162.84:443
Requested byhttps://kts.cvastico.com/in/885/?subid=2044015014&domain=nodomain&target_id=0 CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint55:5D:8B:B6:E4:3E:24:63:E6:9D:7A:AA:44:56:92:9C:22:7E:CD:5A ValidityMon, 07 Oct 2024 08:26:37 GMT - Mon, 30 Dec 2024 08:26:36 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /CheckCookie?continue=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&followup=https%3A%2F%2Fwww.google.com%2Fintl%2Fen%2Fimages%2Flogos%2Faccounts_logo.png&chtml=LoginDoneHtml&checkedDomains=youtube&checkConnection=youtube%3A291%3A1 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kts.cvastico.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 400 Bad Request
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000; includeSubDomains
set-cookie: __Host-GAPS=1:S87_ioMZTiZC6kfkZywvyIxtmpX49w:UeEf79C8ZN6226Q_;Path=/;Expires=Wed, 28-Oct-2026 05:30:51 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
content-security-policy: script-src 'nonce-U-nm1lsLnneCETk-65LpRg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cache-control: no-cache, no-store
pragma: no-cache
expires: Mon, 01-Jan-1990 00:00:00 GMT
content-encoding: gzip
date: Mon, 28 Oct 2024 05:30:51 GMT
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| kts.cvastico.com/in/2669/?subid=2044015014&target_id=0&domain=nodomain&tt={{tt}}&sid={{sid}}&cid={{cid}}&soi={{soi}}&ts={{ts}}&ad_tags=&click_id=cca11d88-90b2-4473-af27-725479f8a4c9&sub_utm_1={{sub_utm_1}}&sub_utm_2={{sub_utm_2}}&&goo=0 | 0.0.0.0 | | 0 B |
URL GET kts.cvastico.com/in/2669/?subid=2044015014&target_id=0&domain=nodomain&tt={{tt}}&sid={{sid}}&cid={{cid}}&soi={{soi}}&ts={{ts}}&ad_tags=&click_id=cca11d88-90b2-4473-af27-725479f8a4c9&sub_utm_1={{sub_utm_1}}&sub_utm_2={{sub_utm_2}}&&goo=0 IP0.0.0.0:0
Requested byhttps://6oszwqmr.xyz/cwns/72p1shtbayoc?referer=bflix.sh CertificateIssuerLet's Encrypt Subjectkts.cvastico.com Fingerprint76:43:00:29:CE:A6:FD:0F:74:6C:44:63:DE:72:67:0F:B9:14:94:32 ValidityMon, 07 Oct 2024 03:11:26 GMT - Sun, 05 Jan 2025 03:11:25 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /in/2669/?subid=2044015014&target_id=0&domain=nodomain&tt={{tt}}&sid={{sid}}&cid={{cid}}&soi={{soi}}&ts={{ts}}&ad_tags=&click_id=cca11d88-90b2-4473-af27-725479f8a4c9&sub_utm_1={{sub_utm_1}}&sub_utm_2={{sub_utm_2}}&&goo=0 HTTP/1.1
Host: kts.cvastico.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kts.cvastico.com/in/885/?subid=2044015014&domain=nodomain&target_id=0
Cookie: 885.0=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|