| GET fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 |  142.250.74.35 | 200 OK | 24 kB |
URL GET fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 IP142.250.74.35:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint63:D6:50:6F:98:C5:59:D1:5A:FF:9D:8D:C3:C1:04:A1:B9:1A:3E:6B ValidityMon, 10 Mar 2025 08:37:01 GMT - Mon, 02 Jun 2025 08:37:00 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 23580, version 1.0 Hashe1b3b5908c9cf23dfb2b9c52b9a023ab fcd4136085f2a03481d9958cc6793a5ed98e714c 918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
GET /s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://www.smoffrs.ru
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 23580
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 27 Mar 2025 09:14:50 GMT
expires: Fri, 27 Mar 2026 09:14:50 GMT
cache-control: public, max-age=31536000
age: 61362
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/js/js.js |  81.30.157.12 | 200 OK | 151 B |
URL GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/js/js.js IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeJavaScript source, ASCII text, with no line terminators Hash7d8a4de33c523490a33fab50a31a3df1 2bb0bdc0eb97f93bb0fbb1a5430bce8c8cfbb789 03a3722f034258658b9c8041d26b24ac5264991bc02edfc921e60b884f0a0413
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bundle/trafee/prelands/43/assets/js/js.js HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/s/42cf1c2250951
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:31 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=86400, public
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/img/u1.jpg | 81.30.157.12 | 200 OK | 33 kB |
URL GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/img/u1.jpg IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 500x667, components 3 Hash5d1b17315ed808bd0f8d82ddfb28e590 eb8d1da39d8a7c09d24609e79abf75478a4ffbd3 884a7432cad6a5c960352e970a53f7c17a8208eced5f58c43f727f0bed806176
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bundle/trafee/prelands/43/assets/img/u1.jpg HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/bundle/trafee/prelands/43/assets/css/style.css
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:32 GMT
content-type: image/jpeg
cache-control: max-age=86400, public
X-Firefox-Spdy: h2
|
|
| GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/img/bg.jpg | 81.30.157.12 | 200 OK | 202 kB |
URL GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/img/bg.jpg IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x1080, components 3 Size202 kB (201964 bytes) Hash8d4702e68d0a5be687984f1e51dd9fc4 ea7f36e3efb63f6d8c005cb599059d52e3009622 780f083aca765f3ccf0aabf16263a794051aaaf73fa074efb469c8bec61643db
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bundle/trafee/prelands/43/assets/img/bg.jpg HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/bundle/trafee/prelands/43/assets/css/style.css
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:32 GMT
content-type: image/jpeg
cache-control: max-age=86400, public
X-Firefox-Spdy: h2
|
|
| | 88.214.27.56 | 200 OK | 1.8 kB |
IP88.214.27.56:443 ASN#209272 Alviva Holding Limited
CertificateIssuerSectigo Limited Subjectgrayvsgray.pw Fingerprint7F:B9:74:BA:4C:EA:1F:77:FB:1B:D7:88:62:E0:9C:E0:AE:4D:37:EB ValidityThu, 06 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (1896), with no line terminators Hash46e5a2c3c6cccbea75a375728b966589 bd9bce69152b23309fd9ea10fc7d6a4fcce0a978 3da605a43f2538a80dad75cb865455e614c390cc574b8a13052123364fcc3d60
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: grayvsgray.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 28 Mar 2025 02:17:29 GMT
Server: Apache/2
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Fri, 21 Mar 2025 18:18:12 GMT
ETag: "6f6-630de46fb2100-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 720
Keep-Alive: timeout=2, max=100
Content-Type: text/html
|
|
| GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/js/jquery-3.2.1.min.js | 81.30.157.12 | 200 OK | 87 kB |
URL GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/js/jquery-3.2.1.min.js IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeJavaScript source, ASCII text, with very long lines (32058) Hashc9f5aeeca3ad37bf2aa006139b935f0a 1055018c28ab41087ef9ccefe411606893dabea2 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bundle/trafee/prelands/43/assets/js/jquery-3.2.1.min.js HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/s/42cf1c2250951
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:31 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=86400, public
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| GET fonts.googleapis.com/css?family=Lato:400,700 | 142.250.74.10 | 200 OK | 1.6 kB |
URL GET fonts.googleapis.com/css?family=Lato:400,700 IP142.250.74.10:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint69:99:38:F9:7C:82:8E:AC:7D:DA:EA:3E:1C:E4:7F:52:1B:36:41:AA ValidityMon, 10 Mar 2025 08:37:02 GMT - Mon, 02 Jun 2025 08:37:01 GMT
File typeASCII text, with very long lines (1588), with no line terminators Hash773216660268a6008bd6fae9c2dfcd0f 14fd680e323867c66d00962ec0eafc87e5bb6fd3 22a29e1129011731e40c11d6742243ce0f95030dc7a430a4c94118b49805dafd
GET /css?family=Lato:400,700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 28 Mar 2025 02:17:32 GMT
date: Fri, 28 Mar 2025 02:17:32 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| GET xn--31-mlcaxniu6i.xn--p1ai/include/mainpage/uymkjp.php?rg=epox |  92.53.96.165 | 200 OK | 84 B |
URL User Request GET xn--31-mlcaxniu6i.xn--p1ai/include/mainpage/uymkjp.php?rg=epox IP92.53.96.165:443
CertificateIssuerLet's Encrypt Subjectxn--31-mlcaxniu6i.xn--p1ai Fingerprint86:22:8A:31:13:D8:52:50:46:B7:A9:FC:1E:2A:51:68:F3:84:FC:6C ValidityFri, 17 Jan 2025 06:03:24 GMT - Thu, 17 Apr 2025 06:03:23 GMT
File typeHTML document, ASCII text, with no line terminators Hash53485340c25077bdaf16e314590302eb 8f19497bae948f4ab24b378e717ed2f6d5338ef6 578a9d54c98b0659b18257ab3c553287c830f7ba7e7ba98992c2790ace9cdfef
GET /include/mainpage/uymkjp.php?rg=epox HTTP/1.1
Host: xn--31-mlcaxniu6i.xn--p1ai
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx/1.26.3
date: Fri, 28 Mar 2025 02:17:28 GMT
content-type: text/html; charset=UTF-8
content-length: 84
X-Firefox-Spdy: h2
|
|
| GET grayvsgray.pw/favicon.ico | 88.214.27.56 | 404 Not Found | 315 B |
URL GET grayvsgray.pw/favicon.ico IP88.214.27.56:443 ASN#209272 Alviva Holding Limited
CertificateIssuerSectigo Limited Subjectgrayvsgray.pw Fingerprint7F:B9:74:BA:4C:EA:1F:77:FB:1B:D7:88:62:E0:9C:E0:AE:4D:37:EB ValidityThu, 06 Mar 2025 00:00:00 GMT - Fri, 06 Mar 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (326), with no line terminators Hash97ef40509b73c101d6815511c3adf98d a4242322497ea630ea72e26ba297a95a2bbe5ccd 322c1f60d9d454c801f7cff3173ef16b61cf9963a64e09a4d9e21d36218b56be
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: grayvsgray.pw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://grayvsgray.pw/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 28 Mar 2025 02:17:29 GMT
Server: Apache/2
Content-Length: 315
Keep-Alive: timeout=2, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
|
| GET www.smoffrs.ru/s/42cf1c2250951 | 81.30.157.12 | 200 OK | 43 kB |
URL User Request GET www.smoffrs.ru/s/42cf1c2250951 IP81.30.157.12:443
CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /s/42cf1c2250951 HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:31 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D; expires=Sat, 29 Mar 2025 02:17:31 GMT; Max-Age=86400; path=/; domain=smoffrs.ru
cache-control: must-revalidate, no-cache, no-store, private
pragma: no-cache
expires: 0
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| GET www.smoffrs.ru/favicon.ico | 81.30.157.12 | 404 Not Found | 993 B |
URL GET www.smoffrs.ru/favicon.ico IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (1034), with no line terminators Hashd905c1e34b39376dc0120a422e2afd07 8c37ad2ecf8eacc6ed4f91240de03b44f712fd8f 1bf5e245475d8aac551c216ee6f97bd55da4f969d90f7bda54b4a03cd0d14df2
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/s/42cf1c2250951
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: openresty
date: Fri, 28 Mar 2025 02:17:32 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Accept
cache-control: no-cache, private
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| GET openfpcdn.io/botd/v1 | 108.157.229.67 | 200 OK | 15 kB |
IP108.157.229.67:443
CertificateIssuerAmazon Subjectopenfpcdn.io FingerprintDB:8B:1E:08:FC:EE:6F:56:28:0B:74:80:37:E0:DE:69:D3:59:96:8D ValidityWed, 27 Nov 2024 00:00:00 GMT - Sat, 27 Dec 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (15005) Hash234a8c1c15df9b03c65e9e14c82fc872 e5ca36727846aede7dfbc07e88b2b025eb0cae90 29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
GET /botd/v1 HTTP/1.1
Host: openfpcdn.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://grayvsgray.pw
DNT: 1
Connection: keep-alive
Referer: https://grayvsgray.pw/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
server: CloudFront
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: br
date: Fri, 28 Mar 2025 00:47:26 GMT
cache-control: public, max-age=606554, s-maxage=10260
etag: W/"5co2cnhGrt59+8B+iLKwJesMrpA"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c26999728b9b80253ea8308df470deba.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P2
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: z07_r51G-HAfASDA8F-Ddq0lmWV6ztZYvR66bQd5bHM2d9EmSvnihw==
age: 5403
X-Firefox-Spdy: h2
|
|
| GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/css/style.css | 81.30.157.12 | 200 OK | 5.6 kB |
URL GET www.smoffrs.ru/bundle/trafee/prelands/43/assets/css/style.css IP81.30.157.12:443
Requested byhttps://www.smoffrs.ru/s/42cf1c2250951 CertificateIssuerLet's Encrypt Subjectsmoffrs.ru Fingerprint18:23:26:08:0D:D9:5D:F3:99:DA:F0:4F:A5:63:AB:85:21:34:9B:36 ValidityFri, 21 Mar 2025 16:35:12 GMT - Thu, 19 Jun 2025 16:35:11 GMT
File typeASCII text, with very long lines (5659), with no line terminators Hashb631f6eb77d78248377f0c2e5a6f10f3 ac554cfc3d057906a93ebc748d71e3af9bc7d3ac 9ebcafbc57ff0eecac3e2febcd4e1d71691b1167f790c876b69b6e2dd763134c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /bundle/trafee/prelands/43/assets/css/style.css HTTP/1.1
Host: www.smoffrs.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.smoffrs.ru/s/42cf1c2250951
Cookie: s=Kan1qKjmfpycYJmLumAQX52KWudBhGzoMxayVSKb8caGUFTzJRUhqgY%2FOGI03wxf07ENJV1dIXCBsfUKvAf0fSB%2BLvYRH%2BMr%2FTdQAmRnYdMztdA5xsumdcTUeGRlIxktO4PvwPxthJvwAHoRJ2PV74tQkV2e2BfGYXhARts1fWjzTLIRhnUqmDLV%2BaGdko2QKqvTRTrR2Bak0KuFHd7wc6xmtYur01Mm7gdmT1yu71p8nv1e5XotrpNZ9uGWVaAZ0VqkcvMETQjrBF8KMBShv6M4Znm3XXzKnU1VG%2F0D0YUrmUrtUyciUypzMlwGXDy01MUa22V3XE5qycBYQ4s%2FevmloY5GDN4OBPPIOtRI8kRRT0cxtkgwHMarubOTcSqqYB595%2BAfBn6j45ArJFuK%2B0GgNlvTiMZxFlW9HjlFk1fSnDb2p9IMQ74UKBf6QEM3uamYDyRl%2BRuz37cpVKMrqUXVsWIAjDO9oie1IrcnIhZBOMrltLqDdKCijp2qDCS9T9H3ud%2Fptz8yM%2FDTk9PVM7hSL23byHsZtkusJF9yopd2x9tfbii%2BvYzSw12Bvj7WiC8bdTFJuz%2BSfdSBgIBcBTcMmTAoHLi5ERBkLK0qGSOCe4kEwdqIqB%2FVnuKx2rQOoCCQM83kWnMywLSr0QSSdhC560BPTz%2B6JzP%2FExuafjYrb3z5FuAQyr6QtqGPEmDP3Wt4G5Q2%2F6Hx7HrnDAEMOOH2DSyIBtv81hupXwy98gbJFHmSvSc%2FfbCNFgpZb5QZpqlfNsy1Bb2xQl0akQQn1Ll2KvAxxg6NLgWTvytOFywyRvxen9FFbKQig1iHkZfLCf4XaMnZmqgsBOtNONrN4frxkazjULH%2Bfgvd0SRiCFbSfIQ6hy9ygX2yC4cVfjUU5oiQwOsO8DLaPGCkhUCyQnUp6KQkQru1YSP7w1X7Go4uiq9P6pHEM1AYZsM2hrkZ%2FeVY7pXSl9VeSYOtMeIScvlQW%2B6j1z3tMl8r51FLnQVHA1BxFuavsp4m5TwZo%2BQ1WCXr0GZEgn6ZbuXclckVcWsuhm6McwnUcxkuCLeAwJEDj39gqGNPhgDqHxxwLRlXN3k2XsRHzOrDbUEP0ugiNxZqxyJ2%2FScyK8C0vO2gX3lce6aU%2FcQL8KUDEfGkrWs1cOV20y6NNnKh%2FrgzJDcOFkDVJcCpx2sxlRIgwzBGor1yt9SM0dIWznoD%2FsaqTBsz6BiSrm38cqmmN0wig%2F82Qvs50TSppsw1l5bPkJnEE9Aoim1chf7WwOT38M1PpNSFmsE9SRnmu%2FB%2Fy6cLB%2Fc9tvBHLg1%2BJMeM83nrL29l%2BG1X%2F4TmXhpusg3LAE1By6gCYVKTnqP2blz6QxyDa0b2imEOWZOH8Jz7DQrflCbcjPal6qGO8sE4JCuDmz8Uxqj9u2Gf%2FgwpekQ5UZFPaOXsg78Vv13gJIzV%2BIS66ob43QpXgBDm4oLX1cXvKXHHFw223I1aWSqZ1sM3g44BlZ29b4L7Op5yPX54BqLiIEJfYXt1uw69DZnygXPYYH%2Fli7kx44lsWBMiJZEfTYmlNLoz%2BCbl3%2B8zlPheHqJeqvX1y1f9QM%2BieCZB5%2Bjpv6N6vGWgYrRPVBNT9IR7BQAFBBSiajXRnZyoKw%2BKn6OcHoE80JDILdkodeFh93MbbHAQ1IGnEKEBKoDZOYGrZyYQ1dJlYYMXKD%2BOR2tGMdGCMEQnyRblbRSh7WDPvDBOuzV9FYCsvMRNEGOTc0HT%2FnkbFhTdnWyAt11gQiWFm2WNZHdUlOjrFY0GfYWyh6NZHjQ59CliRQ%2F5Bo6MAcpFpE4%2BJIyr%2F1VSR1c37hfCpiJZml88LAuFym0jkW3mvFO4KhZo5%2FRRGn5yxQlAjF8BhDmV7K9vKga11tLlsUIn1GVx4saum01kYoMjNkefdXGfUJyfWdBKF9iLpjbQf1QU00N2qM5Dvy6GK6wjWuHSMDdz4WMO9pai%2Fzo3xA1mZ7%2Fm9j1%2F06MLmcpPUwEo9MjYS5cZYj5hK9rd3uiSytqQ2GyGjc4Aqmr7e3hEoTejBdHJfmcmN2SdBHSoz%2BTisOrZkdDsD77mmf%2FX2Squ1g%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Fri, 28 Mar 2025 02:17:31 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
cache-control: max-age=86400, public
content-encoding: gzip
X-Firefox-Spdy: h2
|
|