| cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 |  172.67.158.139 | 200 OK | 0 B |
URL HEAD HTTP/3cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 IP172.67.158.139:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerGoogle Trust Services Subjecttotalsportek.space Fingerprint81:DC:39:20:B0:D7:80:FE:6A:82:99:28:26:EE:1A:DA:CE:90:84:63 ValiditySat, 02 Nov 2024 06:46:45 GMT - Fri, 31 Jan 2025 06:46:44 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD /embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 HTTP/1.1
Host: cdn.totalsportek.space
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 01 Dec 2024 19:25:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nz9s0tx2PvofO3llh8Sa5rxpjU3yEsk97tCrApfxi%2FpDpd5DcPpQMKYud8SrDjCW3pmxFAFdKqvDvPrLsRY%2Ft%2FbQrdPQjIK%2F7GxoFwuRTN%2Bnbb92wS6%2BqYSEJ7qmRMkXiP7PzXvIdkJ6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576c26dda5694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=27412&min_rtt=27026&rtt_var=10905&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4059&recv_bytes=1230&delivery_rate=19718&cwnd=12000&unsent_bytes=0&cid=901fb4f1bbfe74db&ts=540&x=1", cfHdrFlush;dur=0
|
|
| ts.yowdenfalcial.com/rDwQTpfoIlIeWcu/71505 |  172.255.103.103 | 200 OK | 20 B |
URL GET HTTP/1.1ts.yowdenfalcial.com/rDwQTpfoIlIeWcu/71505 IP172.255.103.103:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerLet's Encrypt Subjectts.yowdenfalcial.com Fingerprint1E:55:3B:10:17:79:BA:C9:F4:9E:7F:86:A4:83:47:CA:CD:11:CC:10 ValidityMon, 30 Sep 2024 14:23:16 GMT - Sun, 29 Dec 2024 14:23:15 GMT
File typegzip compressed data, from Unix Hash7029066c27ac6f5ef18d660d5741979a 46c6643f07aa7f6bfe7118de926b86defc5087c4 59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
GET /rDwQTpfoIlIeWcu/71505 HTTP/1.1
Host: ts.yowdenfalcial.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 01 Dec 2024 19:25:34 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://cdn.totalsportek.space
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Mon, 02-Dec-2024 19:25:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Mon, 02-Dec-2024 19:25:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| qd.myosoteruins.com/rUdcK8qZZxyOOpBmq/77025 | 23.109.170.59 | 200 OK | 20 B |
URL GET HTTP/1.1qd.myosoteruins.com/rUdcK8qZZxyOOpBmq/77025 IP23.109.170.59:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerLet's Encrypt Subjectqd.myosoteruins.com Fingerprint67:82:75:00:3B:43:E5:3B:7F:1C:CB:7B:2B:55:DB:DC:E3:DB:C9:5A ValidityMon, 30 Sep 2024 14:19:26 GMT - Sun, 29 Dec 2024 14:19:25 GMT
File typegzip compressed data, from Unix Hash7029066c27ac6f5ef18d660d5741979a 46c6643f07aa7f6bfe7118de926b86defc5087c4 59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
GET /rUdcK8qZZxyOOpBmq/77025 HTTP/1.1
Host: qd.myosoteruins.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 01 Dec 2024 19:25:34 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://cdn.totalsportek.space
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Mon, 02-Dec-2024 19:25:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Mon, 02-Dec-2024 19:25:34 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
|
|
| ptaixout.net/tag.min.js |  139.45.197.244 | 200 OK | 27 kB |
IP139.45.197.244:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerLet's Encrypt Subjectptaixout.net FingerprintEE:B7:7A:A3:2E:F5:C1:DE:27:FC:A2:64:11:D8:AE:DF:54:E0:65:D4 ValidityWed, 13 Nov 2024 05:13:26 GMT - Tue, 11 Feb 2025 05:13:25 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashbb12715dc3535d3f119e18164d83cc6a ee33017dc8c162f0e0655744987622a449cd5d9d c3c606d6aa3b5cf637346347f3c543f2da02f57905106461f0ac39a2469b64ce
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /tag.min.js HTTP/1.1
Host: ptaixout.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 01 Dec 2024 19:25:34 GMT
content-type: text/javascript; charset=utf-8
content-length: 27257
content-encoding: br
x-trace-id: 70a1cb27d471d38dc11b804260f304a1
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
accept-ranges: bytes
last-modified: Sat, 30 Nov 2024 12:08:40 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| cdn.totalsportek.space/favicon.ico | 172.67.158.139 | 404 Not Found | 4.6 kB |
URL GET HTTP/3cdn.totalsportek.space/favicon.ico IP172.67.158.139:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerGoogle Trust Services Subjecttotalsportek.space Fingerprint81:DC:39:20:B0:D7:80:FE:6A:82:99:28:26:EE:1A:DA:CE:90:84:63 ValiditySat, 02 Nov 2024 06:46:45 GMT - Fri, 31 Jan 2025 06:46:44 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash706a98254456810d3e849c3957af9d01 e461d072a6ba8f0082d6f187eba7f053343529c6 8351c0267c2cd7866ff04c04261f06cd75af9a7130aac848ca43fd047404e229
GET /favicon.ico HTTP/1.1
Host: cdn.totalsportek.space
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Sun, 01 Dec 2024 19:25:34 GMT
content-type: text/html
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
age: 144
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FVAR0Awah2rogdAuJultzl%2FDB39U2nAX6oqm%2Fw2cLCjCVBVELo44xa28P%2FuyUqWHJR3DFPZ1mOze0ofCzw08bVV7m3mvc37L6CzTc06nMzFQV%2Buz7uFIoUxU7rzHco9IIa31pqDEBEcc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576c408a85694-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=28878&min_rtt=27026&rtt_var=11111&sent=13&recv=8&lost=0&retrans=0&sent_bytes=4755&recv_bytes=1639&delivery_rate=1345&cwnd=12000&unsent_bytes=0&cid=901fb4f1bbfe74db&ts=762&x=1", cfHdrFlush;dur=0
|
|
| cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 | 172.67.158.139 | 200 OK | 32 kB |
URL HEAD HTTP/3cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 IP172.67.158.139:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerGoogle Trust Services Subjecttotalsportek.space Fingerprint81:DC:39:20:B0:D7:80:FE:6A:82:99:28:26:EE:1A:DA:CE:90:84:63 ValiditySat, 02 Nov 2024 06:46:45 GMT - Fri, 31 Jan 2025 06:46:44 GMT
File typeHTML document, ASCII text, with very long lines (58981) Hash3eb4317272f77a80ff1a47923e49d392 3479046ae44d3c2b18244e4ffb198a2a35136280 fcdc2a0260fe410e0e05b4b81badb8818b5fe5843e97ccc59b37246868712ad2
GET /embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 HTTP/1.1
Host: cdn.totalsportek.space
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:33 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q8Qvr5mxSoz4ek9TTDVPGsPQJzZ8GOoOvCe2Dp794bL%2BACzOozhpgGqZHjk8C1hQuWz0HRWJse8BUnP1o0l%2BauciShmelNfxTJZYBFWh1Mof9IkOgNYmsq8c5A4UKaWqTbDoejvdK2n%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576be5e465691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16660&min_rtt=16561&rtt_var=2808&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3292&recv_bytes=1341&delivery_rate=261308&cwnd=254&unsent_bytes=0&cid=ae967aee4e13d1b8&ts=174&x=0"
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-PQ1PJ56MMF | 142.250.74.168 | 200 OK | 110 kB |
URL GET HTTP/2www.googletagmanager.com/gtag/js?id=G-PQ1PJ56MMF IP142.250.74.168:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subject*.google-analytics.com Fingerprint8F:6D:67:20:75:1C:E2:F2:C3:65:DF:AC:EA:22:D8:AD:ED:0A:08:BA ValidityMon, 21 Oct 2024 08:36:57 GMT - Mon, 13 Jan 2025 08:36:56 GMT
File typeJavaScript source, ASCII text, with very long lines (5945) Size110 kB (109752 bytes) Hash063beecaf092df20fec42e76be29db67 52921bf674883effc407868605ccd77947792b99 16e6dcde2ec07b61d19062cfa10c2f75c8411d15497565a81008c3feaecdfd83
GET /gtag/js?id=G-PQ1PJ56MMF HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sun, 01 Dec 2024 19:25:37 GMT
expires: Sun, 01 Dec 2024 19:25:37 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
server: Google Tag Manager
content-length: 109752
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| js.contentprotectforce.com/js/aclib.js | 188.114.97.1 | 200 OK | 49 kB |
URL GET HTTP/2js.contentprotectforce.com/js/aclib.js IP188.114.97.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectcontentprotectforce.com Fingerprint46:61:21:9A:EE:39:35:55:2E:62:9C:7E:70:3A:3B:E6:26:2D:8E:90 ValidityThu, 10 Oct 2024 17:21:54 GMT - Wed, 08 Jan 2025 17:21:53 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (41604), with NEL line terminators Hash741799c19fffe0910d4a6136b362e148 f8046fff7ced86af7daeb1f19699b0ee9fdc2d45 75e3804b75dc2342339ef3e59e9a5c13fc5dc8813730df7283508c6baaa9ca66
GET /js/aclib.js HTTP/1.1
Host: js.contentprotectforce.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:37 GMT
content-type: application/javascript
last-modified: Sun, 01 Dec 2024 17:00:01 GMT
etag: W/"674c9611-2a34c"
access-control-allow-origin: *
cache-control: max-age=14400
cf-cache-status: HIT
age: 5028
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IALjt9pPkc2bdLyDEVlT7T9CA0x8fTjbYnolYcot8o6aoNxrUjB7EHpKnSZoGd4LBLsIK3YHd1pCjSDLwhjK7nDxFOeYaEB2TvP9DH5FBXNGDR7c3UWk0iYWwkxR7Y0eHVj6SQEO%2FwWVPQAckg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8eb576d25fbc0b69-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16566&min_rtt=16486&rtt_var=2690&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3306&recv_bytes=1203&delivery_rate=260166&cwnd=253&unsent_bytes=0&cid=aedf6bfaa3da6156&ts=56&x=0"
X-Firefox-Spdy: h2
|
|
| streambtw.com/iframe/nfl5.php | 188.114.96.1 | 200 OK | 0 B |
URL HEAD HTTP/3streambtw.com/iframe/nfl5.php IP188.114.96.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectstreambtw.com Fingerprint5A:65:C2:B5:FD:84:93:DB:C9:9D:3B:8B:D9:ED:14:58:7C:9E:DE:A8 ValiditySat, 23 Nov 2024 09:55:53 GMT - Fri, 21 Feb 2025 09:55:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
HEAD /iframe/nfl5.php HTTP/1.1
Host: streambtw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/iframe/nfl5.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cf-cache-status: DYNAMIC
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DhKVtunGsz%2F6WNGWfCBFWjaR99kzGxDXo%2FsWRe9LYZhXuge7KHllFuQVzc1jeKi0TMq%2FLmEBWERGTknfJeLfTaCJ2pNoT17hsi9ulwkCHVgCsyhZslchovmHVDIO2M1o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576e4a81856b9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19745&min_rtt=17853&rtt_var=8046&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4095&recv_bytes=1075&delivery_rate=35959&cwnd=12000&unsent_bytes=0&cid=95aaf6cb03aafef0&ts=3201&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| cdn.jsdelivr.net/npm/clappr@latest/dist/clappr.min.js | 151.101.129.229 | 200 OK | 145 kB |
URL GET HTTP/2cdn.jsdelivr.net/npm/clappr@latest/dist/clappr.min.js IP151.101.129.229:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGlobalSign nv-sa Subjectjsdelivr.net Fingerprint6C:45:F5:9E:D3:37:60:0B:9C:A8:28:29:A4:E6:41:33:BB:2E:76:5C ValidityTue, 30 Jul 2024 15:36:05 GMT - Sun, 31 Aug 2025 15:36:04 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size145 kB (145133 bytes) Hashf55c6c796275a41ce7d97bd160e648ff 936285f9c8c85a749a1ef8cfc4d5e84b7ea2bc89 db7ce4b1edd2c3701c3f2585f7cbd70857173195489a99703ab39de16fa45b6c
GET /npm/clappr@latest/dist/clappr.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 0.3.13
x-jsd-version-type: version
etag: W/"80319-k2KF+cjIWnSaHvjPxNXoS36ivIk"
content-encoding: br
accept-ranges: bytes
date: Sun, 01 Dec 2024 19:25:39 GMT
age: 34081
x-served-by: cache-fra-etou8220029-FRA, cache-hel1410027-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 145133
X-Firefox-Spdy: h2
|
|
| staucheengaichy.net/tag.min.js | 139.45.197.242 | 200 OK | 27 kB |
URL GET HTTP/2staucheengaichy.net/tag.min.js IP139.45.197.242:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerLet's Encrypt Subjectstaucheengaichy.net Fingerprint99:3C:0E:81:99:E3:38:73:CD:F4:61:28:C7:69:AD:DC:28:08:44:9F ValidityWed, 23 Oct 2024 08:45:24 GMT - Tue, 21 Jan 2025 08:45:23 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hashbb12715dc3535d3f119e18164d83cc6a ee33017dc8c162f0e0655744987622a449cd5d9d c3c606d6aa3b5cf637346347f3c543f2da02f57905106461f0ac39a2469b64ce
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /tag.min.js HTTP/1.1
Host: staucheengaichy.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: text/javascript; charset=utf-8
content-length: 27257
content-encoding: br
x-trace-id: cecfc88dbe8b66a448747d46f3a7d9a1
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
accept-ranges: bytes
last-modified: Sat, 30 Nov 2024 12:08:40 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2
|
|
| static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 |  104.16.80.73 | 200 OK | 8.3 kB |
URL GET HTTP/2static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 IP104.16.80.73:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectcloudflareinsights.com FingerprintA3:1D:4E:72:41:6A:D8:04:03:98:90:E7:8B:07:8D:A6:88:FE:B6:A3 ValidityFri, 01 Nov 2024 08:16:38 GMT - Thu, 30 Jan 2025 08:16:37 GMT
File typegzip compressed data, from Unix Hasha8c9821d91344483439ea66172f3af23 2be9361d9eabd722fa44736f73d60d1ffecfccd5 d9913fe6e5e19cc8a91b9cfae6eca6a734e9f428da4b86613a889997c64ee837
GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1
Host: static.cloudflareinsights.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:39 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2024.6.1"
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 8eb576e4d8675693-OSL
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| cdn.jsdelivr.net/npm/clappr@latest/dist/38861cba61c66739c1452c3a71e39852.ttf | 151.101.129.229 | 200 OK | 20 kB |
URL GET HTTP/3cdn.jsdelivr.net/npm/clappr@latest/dist/38861cba61c66739c1452c3a71e39852.ttf IP151.101.129.229:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGlobalSign nv-sa Subjectjsdelivr.net Fingerprint6C:45:F5:9E:D3:37:60:0B:9C:A8:28:29:A4:E6:41:33:BB:2E:76:5C ValidityTue, 30 Jul 2024 15:36:05 GMT - Sun, 31 Aug 2025 15:36:04 GMT
File typeTrueType Font data, 18 tables, 1st "GDEF", 7 names, Microsoft, language 0x409, type 1 string, RobotoRegularVersion 2.001101; 2014Roboto-Regularhttp://www.apache.org/licenses/LICENSE-2.0 Hash38861cba61c66739c1452c3a71e39852 4b1ef58e476b789c97521834abdf7a2fd66d6caf 967e5cecfbfbf64099c3c1232273482dd7436f05714266953c4d2c8ee9c28af5
GET /npm/clappr@latest/dist/38861cba61c66739c1452c3a71e39852.ttf HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
content-length: 19464
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=604800, s-maxage=43200
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/ttf
x-jsd-version: 0.3.13
x-jsd-version-type: version
etag: W/"7f8c-Sx71jkdreJyXUhg0q996L9ZtbK8"
content-encoding: br
accept-ranges: bytes
date: Sun, 01 Dec 2024 19:25:40 GMT
age: 23656
x-served-by: cache-fra-eddf8230027-FRA, cache-hel1410029-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
|
|
| streambtw.com/cdn-cgi/challenge-platform/scripts/jsd/main.js | 188.114.96.1 | 302 Found | 0 B |
URL GET HTTP/3streambtw.com/cdn-cgi/challenge-platform/scripts/jsd/main.js IP188.114.96.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectstreambtw.com Fingerprint5A:65:C2:B5:FD:84:93:DB:C9:9D:3B:8B:D9:ED:14:58:7C:9E:DE:A8 ValiditySat, 23 Nov 2024 09:55:53 GMT - Fri, 21 Feb 2025 09:55:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: streambtw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Sun, 01 Dec 2024 19:25:40 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js?
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
access-control-allow-origin: *
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vbLPNk5PKMNeiWkWPCOul%2BlMz7cvr45ZG294nVzMS%2F4TiA4TOa6HuZlbagaU%2B0Jvm7mFbpdQKdTHsbWiKUeeLpsR8CU04qWt6lFNB9P2OQyN4V6Amrhv%2FReMonkgCvl8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8eb576e77dcd56b9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=19646&min_rtt=17853&rtt_var=6233&sent=13&recv=8&lost=0&retrans=0&sent_bytes=4798&recv_bytes=1362&delivery_rate=212&cwnd=12000&unsent_bytes=0&cid=95aaf6cb03aafef0&ts=3573&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| streambtw.com/cdn-cgi/challenge-platform/h/b/jsd/r/8eb576c2aa275684 | 188.114.96.1 | 200 OK | 0 B |
URL POST HTTP/3streambtw.com/cdn-cgi/challenge-platform/h/b/jsd/r/8eb576c2aa275684 IP188.114.96.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectstreambtw.com Fingerprint5A:65:C2:B5:FD:84:93:DB:C9:9D:3B:8B:D9:ED:14:58:7C:9E:DE:A8 ValiditySat, 23 Nov 2024 09:55:53 GMT - Fri, 21 Feb 2025 09:55:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/challenge-platform/h/b/jsd/r/8eb576c2aa275684 HTTP/1.1
Host: streambtw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12155
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/iframe/nfl5.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
priority: u=3,i=?0
set-cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.streambtw.com; Priority=High; HttpOnly; Secure; SameSite=None
cf_clearance=xgqJFF0gezFX1OXLY5gop_KxpVGZke8a2bRjXjPTmNY-1733081140-1.2.1.1-IBsa3cxmbxCb2RVyGNAssGGHB65kB7N7rjhEwFS86MSGoB.i4nRcFfvtfhgNl5cL84dYJL5TIbScgT9BJ7sA3jWScaFmB3dJ4JKstRRhZRYfIRWDcb2SXeTs1sgC5SNizGM9bPm_pe3hYxEjMPfc2SuApVNLtH7syZhh0j0HO1b3tv0taUZ5fTiSwkUUiKpUtci0OWxZFk5gYYM4x4CSx5aduPun4eA.KY5ZxJLRb3SbfogXGWCROcee0JNXDe0Z7EbaiBfS2e.9aP8bMjv.0ck.onCnE6lA2WNZ20IZte2_jxZ8qnV_xVNi9K4iiw6RyKImq4mttx.kBAP2mNmNBg; Path=/; Expires=Mon, 01-Dec-25 19:25:40 GMT; Domain=.streambtw.com; Priority=High; HttpOnly; Secure; SameSite=None; Partitioned
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hgwPHKMVVpejzqVPkabru5Jece8wCxibAvI0SK3W%2Bv5IwNUhxm%2BlubrOiUtmerh6Ngaki6fBL8ppXxhSxWsVEbcEpJBeavyQO6LFyNK%2B379P2BDjyeVYQj5oeaWtzdIg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576e968ff56b9-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=21965&min_rtt=17853&rtt_var=7772&sent=26&recv=21&lost=0&retrans=0&sent_bytes=10536&recv_bytes=14541&delivery_rate=145122&cwnd=12000&unsent_bytes=0&cid=95aaf6cb03aafef0&ts=3890&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| streambtw.com/cdn-cgi/rum? | 188.114.96.1 | 204 No Content | 0 B |
URL POST HTTP/3streambtw.com/cdn-cgi/rum? IP188.114.96.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectstreambtw.com Fingerprint5A:65:C2:B5:FD:84:93:DB:C9:9D:3B:8B:D9:ED:14:58:7C:9E:DE:A8 ValiditySat, 23 Nov 2024 09:55:53 GMT - Fri, 21 Feb 2025 09:55:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /cdn-cgi/rum? HTTP/1.1
Host: streambtw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
content-type: application/json
Content-Length: 1073
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/iframe/nfl5.php
Cookie: cf_clearance=xgqJFF0gezFX1OXLY5gop_KxpVGZke8a2bRjXjPTmNY-1733081140-1.2.1.1-IBsa3cxmbxCb2RVyGNAssGGHB65kB7N7rjhEwFS86MSGoB.i4nRcFfvtfhgNl5cL84dYJL5TIbScgT9BJ7sA3jWScaFmB3dJ4JKstRRhZRYfIRWDcb2SXeTs1sgC5SNizGM9bPm_pe3hYxEjMPfc2SuApVNLtH7syZhh0j0HO1b3tv0taUZ5fTiSwkUUiKpUtci0OWxZFk5gYYM4x4CSx5aduPun4eA.KY5ZxJLRb3SbfogXGWCROcee0JNXDe0Z7EbaiBfS2e.9aP8bMjv.0ck.onCnE6lA2WNZ20IZte2_jxZ8qnV_xVNi9K4iiw6RyKImq4mttx.kBAP2mNmNBg
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 204 No Content
date: Sun, 01 Dec 2024 19:25:40 GMT
access-control-allow-origin: https://streambtw.com
access-control-allow-methods: POST,OPTIONS
access-control-max-age: 86400
vary: Origin
access-control-allow-credentials: true
server: cloudflare
cf-ray: 8eb576ea0a1556b9-OSL
x-frame-options: DENY
x-content-type-options: nosniff
|
|
| ptaixout.net/5/6320745/?oo=1&aab=1 | 139.45.197.244 | 200 OK | 12 kB |
URL GET HTTP/2ptaixout.net/5/6320745/?oo=1&aab=1 IP139.45.197.244:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerLet's Encrypt Subjectptaixout.net FingerprintEE:B7:7A:A3:2E:F5:C1:DE:27:FC:A2:64:11:D8:AE:DF:54:E0:65:D4 ValidityWed, 13 Nov 2024 05:13:26 GMT - Tue, 11 Feb 2025 05:13:25 GMT
File typegzip compressed data, max speed, from Unix Hashdd443c0a3b1a79c0fcbacaadb4e4d176 cc5813841d841db56659919d2abf494ed75fba9c 8842923ecf891d4362e50246a23323ecd121da52bdd9f03cd550e0d2c19cdc0b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /5/6320745/?oo=1&aab=1 HTTP/1.1
Host: ptaixout.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://cdn.totalsportek.space
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 01 Dec 2024 19:25:34 GMT
content-type: application/json
x-trace-id: 34fc886affd7d1d249235b823904a1f2
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://cdn.totalsportek.space
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=0081251124b94480e5bf3e2add923943; expires=Mon, 01 Dec 2025 19:25:34 GMT; path=/; secure; SameSite=None
oaidts=1733081134; expires=Mon, 01 Dec 2025 19:25:34 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| my.rtmark.net/gid.js?userId=0081251124b94480e5bf3e2add923943 | 188.114.97.1 | 200 OK | 11 kB |
URL GET HTTP/2my.rtmark.net/gid.js?userId=0081251124b94480e5bf3e2add923943 IP188.114.97.1:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerGoogle Trust Services Subjectmy.rtmark.net Fingerprint8A:B7:CD:87:FA:39:07:A8:88:41:1C:9E:2D:0E:97:51:61:75:C1:34 ValidityWed, 06 Nov 2024 10:31:42 GMT - Tue, 04 Feb 2025 10:31:41 GMT
Hashb98dba840373fcc4b94d863f2ed1d33e ed8c60f6ec15669cefbea55b4faf3b9231b10e94 f4344de946d7772def3312c6d0288caf5abdfa62ac003f8af5ae73a5bbc3c402
GET /gid.js?userId=0081251124b94480e5bf3e2add923943 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://cdn.totalsportek.space
DNT: 1
Connection: keep-alive
Referer: https://cdn.totalsportek.space/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:34 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://cdn.totalsportek.space
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
set-cookie: ID=0081251124b94480e5bf3e2add923943; expires=Mon, 01 Dec 2025 19:25:34 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gDwxxtgLhSysnRsfHzZ05e5k%2F64TODNnRXU6Yeae5mZCgPcEC6w9WDnTlAWouc%2FIa98DIj7GoZ7WpzBJuze8a1YfadhKMgWPp1XsXO%2B%2F2XitnPI4W%2B1Y8HMkR81ngBRb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576c5393b56bd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16547&min_rtt=16480&rtt_var=2705&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3205&recv_bytes=1114&delivery_rate=261151&cwnd=253&unsent_bytes=0&cid=366744ad9adfea73&ts=83&x=0"
X-Firefox-Spdy: h2
|
|
| youradexchange.com/script/suurl5.php?r=7102142&cbur=0.4815880799205968&cbiframe=1&cbWidth=1100&cbHeight=619&cbtitle=&cbpage=https%3A%2F%2Fcdn.totalsportek.space%2F&cbref=&cbdescription=&cbkeywords=&cbcdn=pp-lfekpkr.buzz&ufp=Linux%20x86_64%2FMozilla%2FNetscape%2Ftrue%2Ffalse%2F1280x10240en-USunknown4824%20bits&ts=1733081137192&srs=8d502d7ed0c0b44b06889ab3160df22c&atv=56.0&abtg=1&adbv=3-cdn-js | 172.67.177.214 | 200 OK | 926 B |
URL GET HTTP/2youradexchange.com/script/suurl5.php?r=7102142&cbur=0.4815880799205968&cbiframe=1&cbWidth=1100&cbHeight=619&cbtitle=&cbpage=https%3A%2F%2Fcdn.totalsportek.space%2F&cbref=&cbdescription=&cbkeywords=&cbcdn=pp-lfekpkr.buzz&ufp=Linux%20x86_64%2FMozilla%2FNetscape%2Ftrue%2Ffalse%2F1280x10240en-USunknown4824%20bits&ts=1733081137192&srs=8d502d7ed0c0b44b06889ab3160df22c&atv=56.0&abtg=1&adbv=3-cdn-js IP172.67.177.214:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectyouradexchange.com Fingerprint03:7E:C0:10:42:5B:39:CE:2A:03:91:B7:74:65:C7:B0:C7:27:21:4B ValidityTue, 08 Oct 2024 07:34:56 GMT - Mon, 06 Jan 2025 07:34:55 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (955), with no line terminators Hash8ed062aff3d0956d483b440b18651022 5bde8b71ec36ac3685efab88461400065bfd705b cad9743991fad24c751a630fbe82bc28f07e6b15cfd2714317e1c23469d99518
GET /script/suurl5.php?r=7102142&cbur=0.4815880799205968&cbiframe=1&cbWidth=1100&cbHeight=619&cbtitle=&cbpage=https%3A%2F%2Fcdn.totalsportek.space%2F&cbref=&cbdescription=&cbkeywords=&cbcdn=pp-lfekpkr.buzz&ufp=Linux%20x86_64%2FMozilla%2FNetscape%2Ftrue%2Ffalse%2F1280x10240en-USunknown4824%20bits&ts=1733081137192&srs=8d502d7ed0c0b44b06889ab3160df22c&atv=56.0&abtg=1&adbv=3-cdn-js HTTP/1.1
Host: youradexchange.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://streambtw.com/
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:37 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type
content-encoding: gzip
via: 1.1 google
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OsgzJM94m8CB7%2F%2B7YEa%2F6eQGTj2UxiaBc1Bcp4Nctq5ufNUYFQ0LlPsryo0XKEQXLAh3wu26jtEKbZtrzGnJGcAQB8Yxcqya%2Fwec%2BN%2FEwa5VO1kwjNYR2eUHUbBoay7Lp0p3hPM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576d40e88569c-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16640&min_rtt=16483&rtt_var=2759&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3292&recv_bytes=1477&delivery_rate=260994&cwnd=254&unsent_bytes=0&cid=1e499ba5e376c00b&ts=251&x=0"
X-Firefox-Spdy: h2
|
|
| my.rtmark.net/gid.js?userId=008125c66d364ad3f61db47632a68211 | 188.114.97.1 | 200 OK | 65 B |
URL GET HTTP/3my.rtmark.net/gid.js?userId=008125c66d364ad3f61db47632a68211 IP188.114.97.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectmy.rtmark.net Fingerprint8A:B7:CD:87:FA:39:07:A8:88:41:1C:9E:2D:0E:97:51:61:75:C1:34 ValidityWed, 06 Nov 2024 10:31:42 GMT - Tue, 04 Feb 2025 10:31:41 GMT
File typetroff or preprocessor input, ASCII text, with no line terminators Hash3a3505bd94609bbe9e777b9de165b63f 86c8901f0ed4947178a3ca4207c01964fd54d773 97e2613d5215a63e007b4a41ceae985b2d2a1dcc0352d3b5bf7c2a1011b31bfb
GET /gid.js?userId=008125c66d364ad3f61db47632a68211 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Cookie: ID=0081251124b94480e5bf3e2add923943
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://streambtw.com
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
timing-allow-origin: *, *
set-cookie: ID=0081251124b94480e5bf3e2add923943; expires=Mon, 01 Dec 2025 19:25:40 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C23xMmp3w7q%2BbyomwIx2PEhhXW9lXxuC9Cf8cvWxZ3lYdA3%2FOLM%2B4mKYKLyiYYaZO4TaBN8lk9pJINFdJQPqmnF9W0AD9Vg%2FziZ4s1Zr4Tmy9PY6aFdCY6qGAk8%2FEM3h"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8eb576e9ce09b4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=20518&min_rtt=17769&rtt_var=8626&sent=11&recv=6&lost=0&retrans=0&sent_bytes=4048&recv_bytes=1124&delivery_rate=33427&cwnd=12000&unsent_bytes=0&cid=5d6e87a1c4095c42&ts=5835&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ptaixout.net/?rb=7S89ZS6EEj6-TWfpAtuaj66HdpRfzRxSWI-wHEwgsxqyLpxEGbKs4-CQKNNPOQ4JjglYKgB3HyZ6FGSOb-CL7kK9V8E20b083f8zmeQ6jiQeO8pX4IExZh9SWL6YiYIprIuNzgL6Ht7oeCIGE9Ile1zP3gN19wUZ19G8hZ9DoSAhsFPIEZvBCugcCGXRvv-uBMQakG68hplYTEUg56SUIPdnsZgromDoQ7HOxuFSW4k3HrFB4zgwT_M1EVCQevvj0QvW-PRN8RWr3WSb-6TrkHxoprupOgGN&request_ab2=0&zoneid=6320745&js_build=iclick-v1.1016.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=2&pl=https%3A%2F%2Fcdn.totalsportek.space%2Fembed77%2F%3Fask%3D1733079600%26domain%3D%26event%3Dstack.html%26force%3Dhttps%3A%2F%2Fstreambtw.com%2Fiframe%2Fnfl5.php%26lgt%3D4%26link%3D1%26noplayer%3D0&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=3&wgl=&js_build=iclick-v1.1016.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=60963a72-809b-4d7a-8e27-064fb1ca0294&wasm=1&userId=0081251124b94480e5bf3e2add923943&m=link | 139.45.197.244 | 200 OK | 2.9 kB |
URL GET HTTP/2ptaixout.net/?rb=7S89ZS6EEj6-TWfpAtuaj66HdpRfzRxSWI-wHEwgsxqyLpxEGbKs4-CQKNNPOQ4JjglYKgB3HyZ6FGSOb-CL7kK9V8E20b083f8zmeQ6jiQeO8pX4IExZh9SWL6YiYIprIuNzgL6Ht7oeCIGE9Ile1zP3gN19wUZ19G8hZ9DoSAhsFPIEZvBCugcCGXRvv-uBMQakG68hplYTEUg56SUIPdnsZgromDoQ7HOxuFSW4k3HrFB4zgwT_M1EVCQevvj0QvW-PRN8RWr3WSb-6TrkHxoprupOgGN&request_ab2=0&zoneid=6320745&js_build=iclick-v1.1016.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=2&pl=https%3A%2F%2Fcdn.totalsportek.space%2Fembed77%2F%3Fask%3D1733079600%26domain%3D%26event%3Dstack.html%26force%3Dhttps%3A%2F%2Fstreambtw.com%2Fiframe%2Fnfl5.php%26lgt%3D4%26link%3D1%26noplayer%3D0&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=3&wgl=&js_build=iclick-v1.1016.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=60963a72-809b-4d7a-8e27-064fb1ca0294&wasm=1&userId=0081251124b94480e5bf3e2add923943&m=link IP139.45.197.244:443
Requested byhttps://cdn.totalsportek.space/embed77/?ask=1733079600&domain=&event=stack.html&force=https://streambtw.com/iframe/nfl5.php&lgt=4&link=1&noplayer=0 CertificateIssuerLet's Encrypt Subjectptaixout.net FingerprintEE:B7:7A:A3:2E:F5:C1:DE:27:FC:A2:64:11:D8:AE:DF:54:E0:65:D4 ValidityWed, 13 Nov 2024 05:13:26 GMT - Tue, 11 Feb 2025 05:13:25 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (2969), with no line terminators Hash0e8bceecde3e7a65abb892d0f885afcc 92965ec41443915b3713700eb6ca146a9b18b931 16fc7c4038cf1ccbcb554115bf42e70c76c30717cf9cd4ceffee27ccacbecfba
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /?rb=7S89ZS6EEj6-TWfpAtuaj66HdpRfzRxSWI-wHEwgsxqyLpxEGbKs4-CQKNNPOQ4JjglYKgB3HyZ6FGSOb-CL7kK9V8E20b083f8zmeQ6jiQeO8pX4IExZh9SWL6YiYIprIuNzgL6Ht7oeCIGE9Ile1zP3gN19wUZ19G8hZ9DoSAhsFPIEZvBCugcCGXRvv-uBMQakG68hplYTEUg56SUIPdnsZgromDoQ7HOxuFSW4k3HrFB4zgwT_M1EVCQevvj0QvW-PRN8RWr3WSb-6TrkHxoprupOgGN&request_ab2=0&zoneid=6320745&js_build=iclick-v1.1016.0&jsp=1&fs=0&cf=0&sw=1280&sh=1024&wih=1024&wiw=1280&ww=1280&wh=1024&sah=1024&wx=0&wy=0&cw=1280&wfc=2&pl=https%3A%2F%2Fcdn.totalsportek.space%2Fembed77%2F%3Fask%3D1733079600%26domain%3D%26event%3Dstack.html%26force%3Dhttps%3A%2F%2Fstreambtw.com%2Fiframe%2Fnfl5.php%26lgt%3D4%26link%3D1%26noplayer%3D0&drf=&np=1&pt=0&nb=1&ng=0&ix=0&nw=1&tb=false&btz=UTC&bto=0&tt=3&wgl=&js_build=iclick-v1.1016.0&navlng=en-US&vsbl=true&pnt=0&pnrc=0&bs=60963a72-809b-4d7a-8e27-064fb1ca0294&wasm=1&userId=0081251124b94480e5bf3e2add923943&m=link HTTP/1.1
Host: ptaixout.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cdn.totalsportek.space/
Origin: https://cdn.totalsportek.space
DNT: 1
Connection: keep-alive
Cookie: OAID=0081251124b94480e5bf3e2add923943; oaidts=1733081134
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 01 Dec 2024 19:25:35 GMT
content-type: application/json
x-trace-id: 06e704d96814202cb2951dc8efc7f54f
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://cdn.totalsportek.space
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=0081251124b94480e5bf3e2add923943; expires=Mon, 01 Dec 2025 19:25:35 GMT; path=/; secure; SameSite=None
oaidts=1733081135; expires=Mon, 01 Dec 2025 19:25:35 GMT; path=/; secure; SameSite=None
syncedCookie=true; expires=Sun, 08 Dec 2024 19:25:35 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| streambtw.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? | 188.114.96.1 | 200 OK | 8.7 kB |
URL GET HTTP/3streambtw.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? IP188.114.96.1:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectstreambtw.com Fingerprint5A:65:C2:B5:FD:84:93:DB:C9:9D:3B:8B:D9:ED:14:58:7C:9E:DE:A8 ValiditySat, 23 Nov 2024 09:55:53 GMT - Fri, 21 Feb 2025 09:55:52 GMT
File typeJavaScript source, ASCII text, with very long lines (8703), with no line terminators Hash25169f853f72c1deb0434a2b505fe999 7389f75da307d030f67c30415f3290b6eecd5555 255ce7c07f71d4b688addf7e09e04a7656ea8a049fbb84b19c4ba9ef95ccfcb8
GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/a6e12e96a2d5/main.js? HTTP/1.1
Host: streambtw.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
x-content-type-options: nosniff
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3DaZY6FOV3GBV%2FrrZU7D2JGK8O7RV9mtvut0PFaVHqa75f9Nt9%2FWZbKk6klplB%2BgqBbNB8U1GPbXWYS%2BidSxm0q0vlv1eCaWcR4H%2BgVAKEsCQOivBlooOR24Amd6n%2Fez"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8eb576e7ae1956b9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=20390&min_rtt=17853&rtt_var=6165&sent=15&recv=10&lost=0&retrans=0&sent_bytes=5542&recv_bytes=1662&delivery_rate=15722&cwnd=12000&unsent_bytes=0&cid=95aaf6cb03aafef0&ts=3618&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| pp-lfekpkr.buzz/script/ut.js?cb=1733081140432 | 172.67.143.195 | 200 OK | 63 kB |
URL GET HTTP/2pp-lfekpkr.buzz/script/ut.js?cb=1733081140432 IP172.67.143.195:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerGoogle Trust Services Subjectpp-lfekpkr.buzz Fingerprint14:8B:06:CA:C2:A6:32:D9:6C:32:5C:87:6C:6B:22:1A:66:58:A5:AC ValiditySat, 30 Nov 2024 10:36:10 GMT - Fri, 28 Feb 2025 10:36:09 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /script/ut.js?cb=1733081140432 HTTP/1.1
Host: pp-lfekpkr.buzz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: text/javascript
x-goog-generation: 1728560515014783
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 63065
x-goog-hash: crc32c=8dV6jg==, md5=jCS1btpZX9m1Y7FuuSCH1g==
x-goog-storage-class: MULTI_REGIONAL
access-control-allow-origin: *
x-guploader-uploadid: AFiumC7sRUooSGUnUN-t3551xM-brhhXtk6oBBd4NtWp7H2JbdnEdWHEhZoM8ODNRMkV3zhnkl4
access-control-expose-headers: Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
expires: Sun, 01 Dec 2024 18:59:50 GMT
cache-control: public, max-age=14400
age: 2775
last-modified: Thu, 10 Oct 2024 11:41:55 GMT
etag: W/"8c24b56eda595fd9b563b16eb92087d6"
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fb3YHLRy5HyRdLcTKjEt9smQv%2BatEJYrqXov2XRFsaOguOUyVK2G4cyB8qa%2BUi3tYF%2B86pFywp4UOGkXFA4E%2BoUN655gIN895t2X2dUcHaC45gkHBUMaZy4ENMCigGTYGpM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8eb576e838575689-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=16697&min_rtt=16636&rtt_var=3564&sent=7&recv=9&lost=0&retrans=0&sent_bytes=3282&recv_bytes=1168&delivery_rate=260853&cwnd=252&unsent_bytes=0&cid=e98d1541dd0ca20e&ts=54&x=0"
X-Firefox-Spdy: h2
|
|
| luckaltute.net/5/6869446/?oo=1&js_build=iclick-v1.1016.0&dmn=staucheengaichy.net&tt=2&ix=1 | 139.45.197.245 | 200 OK | 3.9 kB |
URL GET HTTP/2luckaltute.net/5/6869446/?oo=1&js_build=iclick-v1.1016.0&dmn=staucheengaichy.net&tt=2&ix=1 IP139.45.197.245:443
Requested byhttps://streambtw.com/iframe/nfl5.php CertificateIssuerLet's Encrypt Subjectluckaltute.net Fingerprint67:6A:83:BF:7E:47:B7:1C:A9:20:AD:87:EF:B1:BE:27:5E:46:1F:76 ValiditySun, 17 Nov 2024 14:59:44 GMT - Sat, 15 Feb 2025 14:59:43 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (3897), with no line terminators Hashd8bbcff3c43ee1a9fa7dc754c647a10c b3b169817665ebaf07e9ba32e8dc2b5cf4e16ed7 3786dea3ca96808ea24bc2a117ebd00d705bcf0052d045234bd70c063c04e197
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /5/6869446/?oo=1&js_build=iclick-v1.1016.0&dmn=staucheengaichy.net&tt=2&ix=1 HTTP/1.1
Host: luckaltute.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://streambtw.com
DNT: 1
Connection: keep-alive
Referer: https://streambtw.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Sun, 01 Dec 2024 19:25:40 GMT
content-type: application/json
x-trace-id: 5a509cfce2050130d78c3ce448deed89
link: <https://my.rtmark.net>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
access-control-allow-origin: https://streambtw.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
timing-allow-origin: *
set-cookie: OAID=008125c66d364ad3f61db47632a68211; expires=Mon, 01 Dec 2025 19:25:40 GMT; path=/; secure; SameSite=None
oaidts=1733081140; expires=Mon, 01 Dec 2025 19:25:40 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
pragma: no-cache, no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT, Mon, 26 Jul 1997 05:00:00 GMT
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
0.0.0.0