Report - c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0

Report Overview

URL

c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
IP

18.193.128.9

ASN

#16509 AMAZON-02
Submitted

2022-11-29T03:14:40Z

Access
Tags

None
urlquery detections

No alerts detected

Detections

urlquery

0
Network Intrusion Detection

0
Threat Detection Systems

16

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
r3.o.lencr.org (14)	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4732	12405	23.36.76.226
contile.services.mozilla.com (1)	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333	229	34.117.237.239
mc.yandex.ru (5)	2672	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4563	76010	87.250.251.119
region1.google-analytics.com (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	720	569	216.239.34.36
ocsp2.globalsign.com (1)	1544	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	357	1897	104.18.20.226
telemetry.jivosite.com (1)	44693	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	467	107	37.230.195.239
www.googletagmanager.com (1)	75	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	388	57640	142.250.74.168
img-getpocket.cdn.mozilla.net (7)	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3800	59331	34.120.237.76
code.jivo.ru (7)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2995	391303	92.223.124.24
webchannel-content.eservice.emarsys.net (1)	13932	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	611	534	34.117.30.199
ocsp.digicert.com (8)	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2728	5514	93.184.220.29
cdn.scarabresearch.com (1)	11242	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	397	23219	54.230.111.20
connect.facebook.net (1)	139	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	380	28638	31.13.72.12
node-sber1-az1-6.jivosite.com (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	463	3590	188.72.107.240
push.services.mozilla.com (1)	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606	127	44.237.93.5
www.facebook.com (1)	99	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	687	349	31.13.72.36
firefox.settings.services.mozilla.com (2)	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782	2373	34.102.187.140
rstat.rockmostbet.com (6)	596584	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2746	414787	162.55.5.93
ocsp.pki.goog (13)	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	4459	9098	142.250.74.35
www.google.no (2)	25607	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1038	1388	142.250.74.35
www.gstatic.com (1)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	455	163959	142.250.74.163
fonts.googleapis.com (1)	8877	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	483	746	142.250.74.10
static.scarabresearch.com (1)	14309	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	389	32675	54.230.111.73
front.cdn-mb.com (1)	769991	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	411	81553	172.67.160.69
ocsp.godaddy.com (1)	698	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	340	2285	192.124.249.36
fonts.gstatic.com (2)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1000	48746	216.58.207.195
c4adbk4m41qwkxamst.com (16)	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	15005	55615	18.193.128.9
content-signature-2.cdn.mozilla.net (1)	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413	5844	34.160.144.191
my.rtmark.net (2)	9054	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1038	17296	139.45.195.8
www.google-analytics.com (1)	40	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	379	20685	142.250.74.174
mostauthor.com (10)	927193	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6843	34096	185.26.99.196
stats.g.doubleclick.net (2)	96	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	1246	1434	142.250.150.156

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed
2022-11-28	medium	c4adbk4m41qwkxamst.com	Sinkholed

HTTP Transactions (114)

URL IP Response Size

c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0

18.193.128.9

308 Permanent Redirect

164

URL HTTP/1.1

c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
IP

18.193.128.9:0
ASN

#16509 AMAZON-02

Magic

HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators

Size

164
Hash

f23c4815ecaef1588f16ac735c0e15d6

026bf8cdd5076014b6fc822878e0086eb44da556

43a81fb3d47b34e7d42d6b8444f592ed9251b8e57db8f67d32419aa40b1480d0

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /partners/casino-reg?cid=1898377687&pid=156181&sip=0 HTTP/1.1
Host: c4adbk4m41qwkxamst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 308 Permanent Redirect
Server: nginx
Date: Tue, 29 Nov 2022 03:14:26 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

2d2e7649ce9e9ba6fc8b68aa89352e3c

0153d1d3d830a457043e16bb40d48a0b9ddef4b8

8eed57c91b42ef7b2d5eff1309e306e23e13c3de21219af24a693cbf3e8977fc

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "8EED57C91B42EF7B2D5EFF1309E306E23E13C3DE21219AF24A693CBF3E8977FC"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4895
Expires: Tue, 29 Nov 2022 04:36:01 GMT
Date: Tue, 29 Nov 2022 03:14:26 GMT
Connection: keep-alive

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

9408cc0694fcbea57966c3a3ba906092

fddcee1fdcf3209298e41a4b1b5560357fa165f0

6ef7120d9463f56e3ddfadd5766d02da8523f34061b13bdba54bf9ab72a1e979

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5584
Cache-Control: max-age=118198
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "63848df9-1d7"
Expires: Wed, 30 Nov 2022 12:04:25 GMT
Last-Modified: Mon, 28 Nov 2022 10:31:21 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

9fce5679881bf302a8978a0b462f01a9

b699fe030ea13ac73813e655c42ed9b531925e2b

a3ec545a8f9364ac9062eddb41279e1465687a1b60f9c1dec6b3a3df8b033eb3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A3EC545A8F9364AC9062EDDB41279E1465687A1B60F9C1DEC6B3A3DF8B033EB3"
Last-Modified: Mon, 28 Nov 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3555
Expires: Tue, 29 Nov 2022 04:13:42 GMT
Date: Tue, 29 Nov 2022 03:14:27 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

34.102.187.140

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

34.102.187.140:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

14cd9a0afb6ba9a763651d5112760d1e

75d7b104ab9ab11fbb73c3f348b43b0119b5adfa

4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Tue, 29 Nov 2022 02:17:51 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 3396
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.76.226

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.76.226:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

6ed178473a81b975a9f193d98fbfafd2

726d1e5f17385774a35211c6af165f8723bfd940

bf031c1a01b9591c41bc8da59c4b9e328fbc55ba6610369c3d2da4d842847e4d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BF031C1A01B9591C41BC8DA59C4B9E328FBC55BA6610369C3D2DA4D842847E4D"
Last-Modified: Mon, 28 Nov 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18764
Expires: Tue, 29 Nov 2022 08:27:11 GMT
Date: Tue, 29 Nov 2022 03:14:27 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

9ebddc2b260d081ebbefee47c037cb28

492bad62a7ca6a74738921ef5ae6f0be5edebf39

74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: jULEHlgXDZGqZqpnDnZ4obEWD2L/DGJht5HGrWF2MAcgwYGVCAssdfPJTpPxl1WsAr4n/taw00c=
x-amz-request-id: EHBV42W59YDPNY7N
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Tue, 29 Nov 2022 02:45:16 GMT
age: 1751
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js

54.230.111.20

200 OK

22699

URL HTTP/1.1

cdn.scarabresearch.com/js/11DAF087E87A3DFD/scarab-v2.js
IP

54.230.111.20:0
ASN

#16509 AMAZON-02

Magic

C source, ASCII text, with very long lines (539)

Size

22699
Hash

bfcc64224f8c6e43e026afb16bd0f4f8

4b1a0dbd96c3047a917ba024690ffc4d544b8b00

c87358a7c76c044147379c9415f96488045b936666093c83fd0e57e08316548e

HTTP Headers

                                        GET /js/11DAF087E87A3DFD/scarab-v2.js HTTP/1.1
Host: cdn.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/javascript;charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
Timing-Allow-Origin: *
Date: Tue, 29 Nov 2022 02:39:36 GMT
Cache-Control: max-age=3600,public
ETag: "aa53180343ab25d32aa7294158ca3216--gzip"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 09ae414c9d6c5323d5147457ada70ec6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: fcppXydHTlFoh0jKmzJwe_H3V4MPhDfGkwKMa83NzTdyWRWJqmDvEg==
Age: 2149

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

09f078994614c29cbf825bc645e49737

1ac4b3058e77286406b31d47be7f019c36910d63

356f7c45987c10b0446803fceb0f0fae0200ee32a0f180a7c1b7b9d0e173ab4b

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2634
Cache-Control: max-age=119526
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "63849eaf-117"
Expires: Wed, 30 Nov 2022 12:26:33 GMT
Last-Modified: Mon, 28 Nov 2022 11:42:39 GMT
Server: ECS (amb/6B8A)
X-Cache: HIT
Content-Length: 279

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

09f078994614c29cbf825bc645e49737

1ac4b3058e77286406b31d47be7f019c36910d63

356f7c45987c10b0446803fceb0f0fae0200ee32a0f180a7c1b7b9d0e173ab4b

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5269
Cache-Control: max-age=122161
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "63849eaf-117"
Expires: Wed, 30 Nov 2022 13:10:28 GMT
Last-Modified: Mon, 28 Nov 2022 11:42:39 GMT
Server: ECS (amb/6B8D)
X-Cache: HIT
Content-Length: 279

c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0

18.193.128.9

200 OK

17728

URL HTTP/2

c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
IP

18.193.128.9:0
ASN

#16509 AMAZON-02

Magic

data

Size

17728
Hash

6d279b6382cbc421a0a1568d6c867ee6

6f1b0b53ff90495b59eb2d8c5e88eaf4d08c27dd

920ca92d3a44b088cfd729db130fb42edc116e6992006ec9a7fddafa72b4c892

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /partners/casino-reg?cid=1898377687&pid=156181&sip=0 HTTP/1.1
Host: c4adbk4m41qwkxamst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 03:14:26 GMT
content-type: text/html
vary: Accept-Encoding
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

09f078994614c29cbf825bc645e49737

1ac4b3058e77286406b31d47be7f019c36910d63

356f7c45987c10b0446803fceb0f0fae0200ee32a0f180a7c1b7b9d0e173ab4b

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2634
Cache-Control: max-age=119526
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "63849eaf-117"
Expires: Wed, 30 Nov 2022 12:26:33 GMT
Last-Modified: Mon, 28 Nov 2022 11:42:39 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 279

rstat.rockmostbet.com/public/rstat_pixel_spa.js

162.55.5.93

200 OK

10374

URL HTTP/2

rstat.rockmostbet.com/public/rstat_pixel_spa.js
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

C source, ASCII text

Size

10374
Hash

beb651622fc41f7197af6c07dc886f25

e59eece7a131b2940fbd0a02fcc74bc39a130d17

f05d3b023d47c83cbf67e7031a8657aab2f282563eb84480c341c44e80097ac1

HTTP Headers

                                        GET /public/rstat_pixel_spa.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
accept-ranges: bytes
content-type: application/javascript
etag: "rlhpsr806"
last-modified: Thu, 17 Nov 2022 11:41:15 GMT
server: Caddy
x-content-type-options: nosniff
content-length: 10374
date: Tue, 29 Nov 2022 03:14:27 GMT
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

09f078994614c29cbf825bc645e49737

1ac4b3058e77286406b31d47be7f019c36910d63

356f7c45987c10b0446803fceb0f0fae0200ee32a0f180a7c1b7b9d0e173ab4b

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=116892
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "63849eaf-117"
Expires: Wed, 30 Nov 2022 11:42:39 GMT
Last-Modified: Mon, 28 Nov 2022 11:42:39 GMT
Server: nginx
Content-Length: 279

static.scarabresearch.com/wpjs/wpes6.js?ts=2760

54.230.111.73

200 OK

32086

URL HTTP/1.1

static.scarabresearch.com/wpjs/wpes6.js?ts=2760
IP

54.230.111.73:0
ASN

#16509 AMAZON-02

Magic

Unicode text, UTF-8 text, with very long lines (65532), with no line terminators

Size

32086
Hash

df1d466f0b998b0494333e59090b098e

d59110ba3d5646ff73afe1a010f7938e3eba327d

90081db7fe04c15837bf4682a45767356a753ea75ced8e2bda93eaa1e67ff0b5

HTTP Headers

                                        GET /wpjs/wpes6.js?ts=2760 HTTP/1.1
Host: static.scarabresearch.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 10 Oct 2022 11:09:51 GMT
x-amz-version-id: B7kEOPd3f.UUaahYeIIXT30URW6wDjD.
Server: AmazonS3
Content-Encoding: gzip
Date: Mon, 28 Nov 2022 09:54:29 GMT
Cache-Control: max-age=86400
ETag: W/"aea14a7926cfb79f14472c23a4b1543b"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: NaHIHCGhnVOuIK8Io4Ivn1dlh067zOe_pkgTGxkqePGTWMd17K0vqw==
Age: 62399

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.35:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

c81653e99cfdfb43236c8d50248b2e51

a33bc0cb7d3bb714b7ef23b059bb304cf23d464f

e75fa0ce568755990d6949ef93e3e5c29213a5a11887f697af901f41b14e0274

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.googletagmanager.com/gtm.js?id=GTM-5PMSX62

142.250.74.168

200 OK

56923

URL HTTP/2

www.googletagmanager.com/gtm.js?id=GTM-5PMSX62
IP

142.250.74.168:0
ASN

#15169 GOOGLE

Magic

Unicode text, UTF-8 text, with very long lines (13906)

Size

56923
Hash

b424400fa609c08be1674dedcf30ded3

1e56c6e0ba63f5c9f3535da2c0acb0bb13b211a4

86d63f71ba33a2dd5506c265c43512ebf05ed96d8d8cebdce3224b902f3824f0

HTTP Headers

                                        GET /gtm.js?id=GTM-5PMSX62 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Tue, 29 Nov 2022 03:14:27 GMT
expires: Tue, 29 Nov 2022 03:14:27 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 56923
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.35

200 OK

472

URL HTTP/1.1

ocsp.pki.goog/gts1c3
IP

142.250.74.35:0
ASN

#15169 GOOGLE

Magic

data

Size

472
Hash

c81653e99cfdfb43236c8d50248b2e51

a33bc0cb7d3bb714b7ef23b059bb304cf23d464f

e75fa0ce568755990d6949ef93e3e5c29213a5a11887f697af901f41b14e0274

HTTP Headers

                                        POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

rstat.rockmostbet.com/lib.js

162.55.5.93

200 OK

236698

URL HTTP/2

rstat.rockmostbet.com/lib.js
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

Unicode text, UTF-8 text, with very long lines (29927), with LF, NEL line terminators

Size

236698
Hash

b85bafd60e6106d783b634d9b8fb9795

1d8e0c977b8169ecb33041352a86a2ea8c6f507c

0849665a57bca225c3f3518af0a1a2ef0f6857fdd497a9c09d3ebe978caed644

HTTP Headers

                                        GET /lib.js HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://c4adbk4m41qwkxamst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
date: Tue, 29 Nov 2022 03:14:27 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=7003194439636090880; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 1
x-xss-protection: 1
content-length: 236698
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

34.102.187.140

200 OK

329

URL HTTP/2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP

34.102.187.140:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (329), with no line terminators

Size

329
Hash

0333b0655111aa68de771adfcc4db243

63f295a144ac87a7c8e23417626724eeca68a7eb

60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

                                        GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Last-Modified, Retry-After, Cache-Control, Content-Type, Pragma, Backoff, ETag, Expires, Content-Length, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Tue, 29 Nov 2022 03:11:13 GMT
cache-control: public,max-age=3600
age: 194
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2

c4adbk4m41qwkxamst.com/partners/sport_logo.png

18.193.128.9

404 Not Found

12580

URL HTTP/2

c4adbk4m41qwkxamst.com/partners/sport_logo.png
IP

18.193.128.9:0
ASN

#16509 AMAZON-02

Magic

data

Size

12580
Hash

d3f27acdf408de69714c8e3dc4bdac95

797634cc6c3d50e465c703c567d15e54af289fea

21b77e0dd5aa97fdc328afe52059da25af1997ac5e53615007c3423131699d0c

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /partners/sport_logo.png HTTP/1.1
Host: c4adbk4m41qwkxamst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
Cookie: theme=desktop
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 404 Not Found
server: nginx
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: text/html
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

7ab2ef968cb6a3078f4b9cb2dda813d4

e669116047ca058a2c1b2999ff0ea8682719162c

6ddecf0b21c44f3851da8efeb6ecdc6c8e9b83d7681153c31952b4ec8c23c940

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6351
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Last-Modified: Tue, 29 Nov 2022 01:28:36 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

rstat.rockmostbet.com/band/t4k.json?

162.55.5.93

200 OK

163758

URL HTTP/2

rstat.rockmostbet.com/band/t4k.json?
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

data

Size

163758
Hash

9aac18d14e291ab5b5f1a6cefe592d65

7acf847328d64793012cfbec29ca20f9e8ef6a8b

194e8e0cf8c0a8644346bc39bd4c50e8b8ba62e1b0bf53428b625010deda6f52

HTTP Headers

                                        POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 660
Origin: https://c4adbk4m41qwkxamst.com
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://c4adbk4m41qwkxamst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Tue, 29 Nov 2022 03:14:27 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=7003194439636090880; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 14
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2

rstat.rockmostbet.com/band/t4k.json?

162.55.5.93

200 OK

URL HTTP/2

rstat.rockmostbet.com/band/t4k.json?
IP

162.55.5.93:0
ASN

#24940 Hetzner Online GmbH

Magic

JSON data\012- , ASCII text, with no line terminators

Size

86
Hash

c9455985ecf269a3394a6668ce5b6775

db95286942f210fb50b5ddf951b36bd63d32d30a

403eb5fb8be9590a819c6dcc8f0a828130be2a029b50ef66e3f4ff3faa59343c

HTTP Headers

                                        POST /band/t4k.json? HTTP/1.1
Host: rstat.rockmostbet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 747
Origin: https://c4adbk4m41qwkxamst.com
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
access-control-allow-credentials: true
access-control-allow-origin: https://c4adbk4m41qwkxamst.com
access-control-expose-headers: Content-Length,Content-Type
cache-control: no-cache, no-store, must-revalidate
date: Tue, 29 Nov 2022 03:14:27 GMT
expires: Mon, 01 Jan 1990 21:00:12 GMT
last-modified: Sun, 17 May 1998 03:44:30 GMT
pragma: no-cache
server: Caddy
set-cookie: uid=7003194439636090880; Domain=.rockmostbet.com; Path=/; Expires=Sun, 30 Mar 2025 08:29:13 GMT; HttpOnly
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-response-time: 14
x-xss-protection: 1
content-type: text/plain; charset=utf-8
content-length: 86
X-Firefox-Spdy: h2

my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01

139.45.195.8

200 OK

16087

URL HTTP/2

my.rtmark.net/p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01
IP

139.45.195.8:0
ASN

#9002 RETN Limited

Magic

data

Size

16087
Hash

581560c5aadac63ecba0be26949b86ce

aa507d05a1488ecf9b69a1991de125ae0630f694

c50387748db2d5ec4ee4bc1d28ed1613e0864417b1bc1e988f423807a9951366

HTTP Headers

                                        GET /p.js?f=sync&lr=1&partner=8900e7870715b2f6f27ac0859edcc81719d5b1da87a5615f24096125f4502d01 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: text/javascript
content-length: 697
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

af25abbc1f9776cf78b07837dbea38a0

1883049bac2e92f8b3107f6435f00b83d8f4c117

663a6d77de7e3c835bcbb4b567eb28053755bf50ddab14b3f668367a85efdf17

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4444
Cache-Control: max-age=119924
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:27 GMT
Etag: "6384992b-1d7"
Expires: Wed, 30 Nov 2022 12:33:11 GMT
Last-Modified: Mon, 28 Nov 2022 11:19:07 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

www.google-analytics.com/analytics.js

142.250.74.174

200 OK

20039

URL HTTP/2

www.google-analytics.com/analytics.js
IP

142.250.74.174:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (1325)

Size

20039
Hash

47e6f374ca946fddd5b59871b325736c

baa9282efc8785e84d247c3bff518eaa45f101c4

16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e

HTTP Headers

                                        GET /analytics.js HTTP/1.1
Host: www.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Tue, 29 Nov 2022 02:41:08 GMT
expires: Tue, 29 Nov 2022 04:41:08 GMT
cache-control: public, max-age=7200
age: 1999
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
content-type: text/javascript
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

connect.facebook.net/en_US/fbevents.js

31.13.72.12

200 OK

27340

URL HTTP/2

connect.facebook.net/en_US/fbevents.js
IP

31.13.72.12:0
ASN

#32934 FACEBOOK

Magic

ASCII text, with very long lines (64348)

Size

27340
Hash

44ecaa3c2a4929a40141edc4540aaf84

f29a573182333b2500d41bfc389d6c5232dfb348

6589fe14578dedd4df678a909afadd7e5bc7f57c7e3e24518a7f5faac7383396

HTTP Headers

                                        GET /en_US/fbevents.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-type: application/x-javascript; charset=utf-8
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: zjAJn/BZPu0WABGI3/R4NQq9QVBfYA+AnEdBibkoFuNTPal5RbOG/KqCrbn/kkBaSQjC2zib8KTtWJUoxm6y6Q==
priority: u=3,i
content-length: 27340
x-fb-trip-id: 1904183273
date: Tue, 29 Nov 2022 03:14:27 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

af25abbc1f9776cf78b07837dbea38a0

1883049bac2e92f8b3107f6435f00b83d8f4c117

663a6d77de7e3c835bcbb4b567eb28053755bf50ddab14b3f668367a85efdf17

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4445
Cache-Control: max-age=119924
Content-Type: application/ocsp-response
Date: Tue, 29 Nov 2022 03:14:28 GMT
Etag: "6384992b-1d7"
Expires: Wed, 30 Nov 2022 12:33:12 GMT
Last-Modified: Mon, 28 Nov 2022 11:19:07 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

front.cdn-mb.com/spa-static/1.4.1028/static/js/main.6052022b.chunk.js

172.67.160.69

200 OK

80764

URL HTTP/2

front.cdn-mb.com/spa-static/1.4.1028/static/js/main.6052022b.chunk.js
IP

172.67.160.69:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (65536), with no line terminators

Size

80764
Hash

ec005c68af55a3871bf337039eb39d82

9c10693559490bbd7c41eed15bf45237b6b9a187

cf61d1bcc5b30dec6fb90d701feb2c9ef8957e820eb3de0f17893b72e34ab0e3

HTTP Headers

                                        GET /spa-static/1.4.1028/static/js/main.6052022b.chunk.js HTTP/1.1
Host: front.cdn-mb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: application/javascript
last-modified: Mon, 28 Nov 2022 09:59:56 GMT
vary: Accept-Encoding
etag: W/"6384869c-5c036"
expires: Tue, 29 Nov 2022 06:27:59 GMT
cache-control: max-age=14400
access-control-allow-origin: *
cf-cache-status: HIT
age: 2788
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HiF4%2B68eakd7KTkrLWiDlpX4K8T0ph4P1HttzJKUpWV25s4IuUqAgjk5Dj%2F0rhHgBTC5wcURGbDkG5zmw2u26kcGcyfRw94eMcUOzW8MkfO5Am624%2B3E4IzXf85NBus58Phh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77182c58f866b51b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

mc.yandex.ru/metrika/tag.js

87.250.251.119

200 OK

73267

URL HTTP/2

mc.yandex.ru/metrika/tag.js
IP

87.250.251.119:0
ASN

#13238 YANDEX LLC

Magic

Unicode text, UTF-8 (with BOM) text, with very long lines (587)

Size

73267
Hash

1d79426653c3b55939eaec59a2ce8ef5

c6db0314df7a4e5c08047f6306e0b79a1ad3bab2

2729cfe8b2f5142cf99734cbb4e1a3c6cd35868d279cd796db49ef62742ef993

HTTP Headers

                                        GET /metrika/tag.js HTTP/1.1
Host: mc.yandex.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
content-length: 73267
date: Tue, 29 Nov 2022 03:14:28 GMT
access-control-allow-origin: *
etag: "6384bff1-11e33"
expires: Tue, 29 Nov 2022 04:14:28 GMT
last-modified: Mon, 28 Nov 2022 17:04:33 GMT
cache-control: max-age=3600
content-encoding: br
content-type: application/javascript
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

c4adbk4m41qwkxamst.com/api/v1/websocket/credentials

18.193.128.9

200 OK

241

URL HTTP/2

c4adbk4m41qwkxamst.com/api/v1/websocket/credentials
IP

18.193.128.9:0
ASN

#16509 AMAZON-02

Magic

data

Size

241
Hash

4b5ef948c468999ecc7b5b0564f7a322

eb4a3ba2b34e6dafc57a699723a692b7b3948057

0b6e3f8f348852fb8f13a8155bbbef7239b8a4daad9c0cb386bf7d69f446a6c6

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /api/v1/websocket/credentials HTTP/1.1
Host: c4adbk4m41qwkxamst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1028
x-client-session: 6ux0f48kud0z7rk4i6eb
x-client-device-id: 01ls709vj3lz7lvtao38
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
Cookie: theme=desktop; rst-uid=7003194439636090880
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 9f51f1ee2181af1d866f96da9a47231a
vary: Accept-Encoding, Accept-Language
expires: Tue, 29 Nov 2022 03:14:28 GMT
set-cookie: PHPSESSID=cgetd3b5anskd1689cavprla4g; expires=Thu, 29-Dec-2022 03:14:27 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Wed, 30-Nov-2022 03:14:28 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Tue, 06-Dec-2022 03:14:28 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

c4adbk4m41qwkxamst.com/api/v1/settings

18.193.128.9

200 OK

380

URL HTTP/2

c4adbk4m41qwkxamst.com/api/v1/settings
IP

18.193.128.9:0
ASN

#16509 AMAZON-02

Magic

data

Size

380
Hash

c611686936425b95d0b288c4a786e49c

16f7a4bff89c55260424034b1bcf5eea3330e149

cd2df1e2e9c562ca7636b5cb84f0f25e68c1d2555ba632b4b8c999411ba2a4ad

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

                                        GET /api/v1/settings HTTP/1.1
Host: c4adbk4m41qwkxamst.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
x-client-name: mostbet-com-spa
x-client-version: 1.4.1028
x-client-session: 6ux0f48kud0z7rk4i6eb
x-client-device-id: 01ls709vj3lz7lvtao38
X-Requested-With: XMLHttpRequest
x-client-platform: desktop-web
Connection: keep-alive
Referer: https://c4adbk4m41qwkxamst.com/partners/casino-reg?cid=1898377687&pid=156181&sip=0
Cookie: theme=desktop; rst-uid=7003194439636090880
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

                                        HTTP/2 200 OK
server: nginx
date: Tue, 29 Nov 2022 03:14:27 GMT
content-type: application/json
cache-control: max-age=0, must-revalidate, private
x-request-id: 6a87ee26a6a1bf1a3f902f7f7965eb6e
vary: Accept-Encoding, Accept-Language
expires: Tue, 29 Nov 2022 03:14:27 GMT
set-cookie: PHPSESSID=o12546tmq73fi3jpnrfncindht; expires=Thu, 29-Dec-2022 03:14:27 GMT; Max-Age=2592000; path=/; secure; HttpOnly
lunetics_locale=bn; expires=Wed, 30-Nov-2022 03:14:27 GMT; Max-Age=86400; path=/; secure
tz=Europe%2FOslo; expires=Tue, 06-Dec-2022 03:14:27 GMT; Max-Age=604800; path=/; secure
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

push.services.mozilla.com/

44.237.93.5

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

44.237.93.5:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Cu4beucX17CnXHRWAxHshg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: HPXCB016tUL001u5C5zrba/dW8M=

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (55)

#1 JS:Script (size: 10325)

#2 JS:Script (size: 102837)

#3 JS:Script (size: 565)

#4 JS:Script (size: 607316)

#5 JS:Script (size: 213877)

#6 JS:Script (size: 287)

#7 JS:Script (size: 35875)

#8 JS:Script (size: 97421)

#9 JS:Script (size: 31907)

#10 JS:Script (size: 502884)

#11 JS:Script (size: 50230)

#12 JS:Script (size: 909)

#13 JS:Script (size: 19785)

#14 JS:Script (size: 441755)

#15 JS:Script (size: 295)

#16 JS:Script (size: 10374)

#17 JS:Script (size: 180)

#18 JS:Script (size: 105267)

#19 JS:Script (size: 300563)

#20 JS:Script (size: 48184)

#21 JS:Script (size: 69)

#22 JS:Script (size: 365)

#23 JS:Script (size: 271750)

#24 JS:Script (size: 0)

#25 JS:Script (size: 37)

#26 JS:Script (size: 482)

#27 JS:Script (size: 697)

#28 JS:Script (size: 178)

#29 JS:Script (size: 1115732)

#30 JS:Script (size: 11729)

#31 JS:Script (size: 17132)

#32 JS:Script (size: 376886)

#33 JS:Script (size: 505)

#34 JS:Script (size: 167510)

#35 JS:Script (size: 236698)

#36 JS:Script (size: 382)

#37 JS:Script (size: 228783)

#38 JS:Script (size: 61873)

#1 JS:Eval (size: 391)

#2 JS:Eval (size: 193)

#3 JS:Eval (size: 193)

#4 JS:Eval (size: 994)

#5 JS:Eval (size: 22)

#6 JS:Eval (size: 3)

#7 JS:Eval (size: 64)

#8 JS:Eval (size: 194)

#9 JS:Eval (size: 16375)

#10 JS:Eval (size: 30)

#11 JS:Eval (size: 15576)

#12 JS:Eval (size: 22)

#13 JS:Eval (size: 193)

#14 JS:Eval (size: 209)

#15 JS:Eval (size: 194)

#16 JS:Eval (size: 20855)

#1 JS:Write (size: 1115881)

HTTP Transactions (114)

URL HTTP/1.1