Report - gotoadexchange.com/jump/next.php?stamat=m|,UIjer43KqB1dQO0dEdHP3xP.137,S0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM9LqtHQw5P0iR5GSIKXArsrqxYVMxKI9BdQ5OfPxza1kw,,&cbpage=https://onclickalgo.com/jump/next.php?r=6808846&sub2=8047622&cbur=0.14550626106876674&cbtitle=&cbiframe=0&cbWidth=1536&cbHeight=864&cbdescription=&cbkeywords=&cbref=/

Report Overview

Submitted URL
gotoadexchange.com/jump/next.php?stamat=m|,UIjer43KqB1dQO0dEdHP3xP.137,S0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM9LqtHQw5P0iR5GSIKXArsrqxYVMxKI9BdQ5OfPxza1kw,,&cbpage=https://onclickalgo.com/jump/next.php?r=6808846&sub2=8047622&cbur=0.14550626106876674&cbtitle=&cbiframe=0&cbWidth=1536&cbHeight=864&cbdescription=&cbkeywords=&cbref=/
IP
172.67.168.96
ASN
#13335 CLOUDFLARENET
Submitted
2024-03-28 10:21:41
Access
public
Website Title
Free Sex Cams, Live Sex Chat 24/7
Final URL
thotslive.xyz/lowla/index.html
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
16

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
v.bondagani.org	unknown	unknown	No data	No data	609 B	1.0 kB	207.246.125.206
thotslive.xyz	unknown	unknown	No data	No data	3.8 kB	4.5 MB	104.21.75.150
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-03-28	859 B	120 kB	104.17.24.14
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-03-28	524 B	34 kB	216.58.207.227
gotoadexchange.com	unknown	2023-07-27	2023-07-27	2024-03-27	2.0 kB	107 kB	104.21.62.156

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed
2024-03-28	medium	thotslive.xyz	Sinkholed

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js	88 kB	2023-03-07	2024-04-27
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-27 12:25:35 Times Seen95827 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	thotslive.xyz/lowla/index.html	2.1 kB	2024-03-28	2024-03-28
Pretty URL thotslive.xyz/lowla/index.html IP 104.21.75.150 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-28 11:21:48 Last Seen2024-03-28 21:55:33 Times Seen2 Hash 5d8c015d44ed4ea1994fc19dd276e0fb c1a7871bd70937fd90b485887f8d923f6296d7fa d71fbd6d288a21ca20a513347ce10a3d778f5e745e6957d43efcc914174036f2 Loading...

	cdnjs.cloudflare.com/ajax/libs/video.js/7.0.5/video.min.js	399 kB	2023-03-08	2024-03-28
Pretty URL cdnjs.cloudflare.com/ajax/libs/video.js/7.0.5/video.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 16:37:07 Last Seen2024-03-28 21:55:33 Times Seen42 Hash f94eb284e3cdece4471472867e0fe4a0 7f54a71c47a88aa0b9de2a565722eef550a3b6c5 9bff4b5eb0133e6ac53e88bfb1f794a6e835d3effb5fa6b52bfb1989c968ebfc Loading...

HTTP Transactions (14)

URL IP Response Size

v.bondagani.org/base.php?c=5&key=3ff2940912f3f064a7449328c657870d&zone=6808846-0-1048998251&redcost=&clkid=171162127510000TNOTV415326358024Vd9&ban=23751586

207.246.125.206

302 Found

0 B

URL User Request GET HTTP/1.1
v.bondagani.org/base.php?c=5&key=3ff2940912f3f064a7449328c657870d&zone=6808846-0-1048998251&redcost=&clkid=171162127510000TNOTV415326358024Vd9&ban=23751586
IP
207.246.125.206:443
ASN
#20473 AS-CHOOPA

Certificate
IssuerLet's Encrypt
Subjectv.bondagani.org
Fingerprint88:3D:B0:D1:0D:14:EC:AF:FA:71:2D:FD:83:31:6D:FD:02:6F:2D:6F
ValidityThu, 01 Feb 2024 09:47:33 GMT - Wed, 01 May 2024 09:47:32 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /base.php?c=5&key=3ff2940912f3f064a7449328c657870d&zone=6808846-0-1048998251&redcost=&clkid=171162127510000TNOTV415326358024Vd9&ban=23751586 HTTP/1.1
Host: v.bondagani.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Date: Thu, 28 Mar 2024 10:21:16 GMT
Server: Apache/2.4.52 (Ubuntu)
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=njsquf6use6jns0s87djmd6d06; path=/
cpvlabclick=NjV5b3l1NXZfNV8xN18yMV8xNTgxNDcxMF84; expires=Sat, 27-Apr-2024 10:21:16 GMT; Max-Age=2592000; domain=.bondagani.org; secure; SameSite=None
cpvlabsubid=65yoyu5v_5_15814710; expires=Sat, 27-Apr-2024 10:21:16 GMT; Max-Age=2592000; domain=.bondagani.org; secure; SameSite=None
cpvlablevel=1; expires=Sat, 27-Apr-2024 10:21:16 GMT; Max-Age=2592000; domain=.bondagani.org; secure; SameSite=None
cpvlabclicks=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; domain=.bondagani.org; secure; SameSite=None
Location: https://thotslive.xyz/lowla/index.html
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

thotslive.xyz/lowla/img/thotslive.png

104.21.75.150

200 OK

8.4 kB

URL GET HTTP/3
thotslive.xyz/lowla/img/thotslive.png
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
PNG image data, 300 x 100, 8-bit/color RGBA, non-interlaced
Size
8.4 kB (8395 bytes)
Hash
0e7743f29192d51757d8582f9c433977
7f25e8e149ad95741df19fb2262cdb46d0e64c0a
35bdd3116eabc7bb24c7273d990a7f0eea4d454a2403182b51681de77550700a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/img/thotslive.png HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: image/png
content-length: 8395
last-modified: Wed, 25 Oct 2023 20:28:30 GMT
etag: "20cb-608904c6edf7c"
cache-control: max-age=14400
cf-cache-status: HIT
age: 556
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=unOI3TOS6t3hXHtsYar7IhMWOQBBnaQbIHGwARc%2FDTtAj5O1H4xq1KEGZvChcCzRyVYwHVM5EWVtbfYA10JtU1WZZz0HX59SiripIdha%2FlDytKwGWGJJq66xRqu0sFBr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b6e4737cc70b49-OSL
alt-svc: h3=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

104.17.24.14

200 OK

28 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
28 kB (27748 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: application/javascript; charset=utf-8
content-length: 27748
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-15851"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 650249
expires: Tue, 18 Mar 2025 10:21:16 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=acvh989EQvcUnHPAhPzh1X3McM0SwmAXPEDqEwzvSxSDl7QZt%2BXSTVvX9%2FHrL7Re3Q3JcPqHc44vlKKoUx6Hw1HwD%2FTBiXFkES3ojCbLvdE6UNoDhOo%2FWq1ASKWJqAfOQxveHYYL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 86b6e4739b2556b9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/video.js/7.0.5/video.min.js

104.17.24.14

200 OK

90 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/video.js/7.0.5/video.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (65141)
Size
90 kB (90350 bytes)
Hash
f94eb284e3cdece4471472867e0fe4a0
7f54a71c47a88aa0b9de2a565722eef550a3b6c5
9bff4b5eb0133e6ac53e88bfb1f794a6e835d3effb5fa6b52bfb1989c968ebfc

HTTP Headers

GET /ajax/libs/video.js/7.0.5/video.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: application/javascript; charset=utf-8
content-length: 90350
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb0401f-614ed"
last-modified: Mon, 04 May 2020 16:17:35 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 645665
expires: Tue, 18 Mar 2025 10:21:16 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DJfBY8sfEthHYyIHiYrkuDj70xjrBxwnCVtRBFQUxCGQH6IbJoYhAh5OoM6rCWBQ4idX3C9YbNbLrtdnbBfbQTDz4LK%2FexzNJgiwHPTnzSv%2B0MWWGaechzn3i6t0a9dYkZKfRJtm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 86b6e4739b2456b9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

thotslive.xyz/lowla/css/video-js.min.css

104.21.75.150

200 OK

1.1 MB

URL GET HTTP/3
thotslive.xyz/lowla/css/video-js.min.css
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
ASCII text, with very long lines (867)
Size
1.1 MB (1108811 bytes)
Hash
0489f6dda3ddc07343dd02bb19798d02
cae90c4521c51395f005b0308d505666928e0dc7
288ea81eaa52f58e67182dc8f7a6c4df060b3f295daca4f2c740b57f861bb291

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/css/video-js.min.css HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: text/css
last-modified: Wed, 25 Oct 2023 20:28:29 GMT
etag: W/"94a3-608904c5982c0-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
age: 556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iaBLAu6tJ9JLXaCN9Y%2BJKjC%2BhMIrFDdAcJutqU45NDryEVXK98mAwWglWqJZtwTv0gworcATlkiEakKG%2F10NPX2b%2BIUOuZr0wg%2FjBYjGAGZZ%2B9D2Ko2ovwBYBLO8q%2BA0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e4737cc10b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

thotslive.xyz/lowla/css/header.css

104.21.75.150

200 OK

1.1 MB

URL GET HTTP/3
thotslive.xyz/lowla/css/header.css
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
ASCII text, with CRLF line terminators
Size
1.1 MB (1103575 bytes)
Hash
5c27b51baf3e645aeb515d5cb71e0cd6
d5de3aaa63668518df6aedd7e50bb0548221df95
5b173ef59811582f8ca004f3f351a8e7f881a9bf1f7bf18b85177f031649232c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/css/header.css HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: text/css
last-modified: Wed, 25 Oct 2023 20:28:30 GMT
etag: W/"158b-608904c61cfbe-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
age: 556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xbvLChRV15yQNynFfPymjJLdq2hYqZRRk5apzbk3P%2Bj8rVbH7TxKBfSwv0hboQN19AgDsVunAKvBAbHmdrJKVq75DE2%2BNuwD8bArpBbdmR7PE6VOS%2FtIPW%2FItn2EFGkn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e4737cbf0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2

216.58.207.227

200 OK

33 kB

URL GET HTTP/2
fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF3:56:10:42:A8:3C:BF:F5:89:9C:4C:C0:F8:E3:DC:C4:1C:E9:34:9E
ValidityMon, 26 Feb 2024 08:18:21 GMT - Mon, 20 May 2024 08:18:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 33148, version 1.0
Size
33 kB (33148 bytes)
Hash
e88b1871ed8eef59b7df05a91a6f2157
feebf868e5bc28362677fd6e92ac3d41c5c9715e
34208e63c50cc27f5c13b0c29629cf0561fa788f564a07f82cf877dc28e46b82

HTTP Headers

GET /s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://thotslive.xyz
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 33148
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 28 Mar 2024 02:32:53 GMT
expires: Fri, 28 Mar 2025 02:32:53 GMT
cache-control: public, max-age=31536000
age: 28104
last-modified: Wed, 13 Sep 2023 22:39:50 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

thotslive.xyz/lowla/css/css2.css

104.21.75.150

200 OK

34 kB

URL GET HTTP/3
thotslive.xyz/lowla/css/css2.css
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
ASCII text
Size
34 kB (33717 bytes)
Hash
918faeccef0130946345900a45bd8f3b
912d5348b8a49c87ed0196652a54ae7d6814c5f8
4fefa55d5043c76ce50b795a3d8414c059b70f6cf759a8a9a7913bc4e62b4c4a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/css/css2.css HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: text/css
last-modified: Wed, 25 Oct 2023 20:28:29 GMT
etag: W/"1d0c-608904c5feb5f-gzip"
vary: Accept-Encoding
cache-control: max-age=14400
cf-cache-status: HIT
age: 556
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=385YMkvEkO6sWRGW6DJn%2BHuIAoOYZM%2FETbTVe%2Fp7O41EFvFhQ9QI3eMwhp3ffxAohv8DVix7tO2vjhZRzh4uVR0jIRPKjDzcvY%2Feexhi0e0Ey%2BRwtT4MdEtHXX7eT7b3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e4737cc00b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

thotslive.xyz/favicon.ico

104.21.75.150

404 Not Found

13 kB

URL GET HTTP/3
thotslive.xyz/favicon.ico
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
HTML document, ASCII text
Size
13 kB (13410 bytes)
Hash
b8120e9dc14dd4b562dd99f83fa348c7
b9db9d8bdd17c5cf5204f12c16c171c9ca91116d
2f20d9af2bfd9c9e53f6f91b96d0ca63c085d2a612b7eca601d0fac65c4c9743

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Thu, 28 Mar 2024 10:21:17 GMT
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AQLn8CnsQ5cP0srMPGCuaCNe5CK2i4TzAqzDlj4rYEPSdbkjSZTRTHa6hMtP9zs78p1usW4K9KOlYnzaGUFHCAglBieUVCzcA9hHx0yxnX5dDRLg3kUe44F5pduST8u8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b6e477af740b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

gotoadexchange.com/jump/next.php?stamat=m|,UIjer43KqB1dQO0dEdHP3xP.137,S0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM9LqtHQw5P0iR5GSIKXArsrqxYVMxKI9BdQ5OfPxza1kw,,&cbpage=https://onclickalgo.com/jump/next.php?r=6808846&sub2=8047622&cbur=0.14550626106876674&cbtitle=&cbiframe=0&cbWidth=1536&cbHeight=864&cbdescription=&cbkeywords=&cbref=/

104.21.62.156

302 Found

52 kB

URL User Request GET HTTP/2
gotoadexchange.com/jump/next.php?stamat=m|,UIjer43KqB1dQO0dEdHP3xP.137,S0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM9LqtHQw5P0iR5GSIKXArsrqxYVMxKI9BdQ5OfPxza1kw,,&cbpage=https://onclickalgo.com/jump/next.php?r=6808846&sub2=8047622&cbur=0.14550626106876674&cbtitle=&cbiframe=0&cbWidth=1536&cbHeight=864&cbdescription=&cbkeywords=&cbref=/
IP
104.21.62.156:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectgotoadexchange.com
Fingerprint18:99:88:5D:65:C6:02:E1:5F:94:CA:2A:9B:82:49:97:A5:37:F6:23
ValidityTue, 19 Mar 2024 13:41:39 GMT - Mon, 17 Jun 2024 13:41:38 GMT

File type

Size
52 kB (52269 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /jump/next.php?stamat=m|,UIjer43KqB1dQO0dEdHP3xP.137,S0kXXHXf2ck-DOZ9HRvwuM9aL_G46JdZU-2oa3bmXM9LqtHQw5P0iR5GSIKXArsrqxYVMxKI9BdQ5OfPxza1kw,,&cbpage=https://onclickalgo.com/jump/next.php?r=6808846&sub2=8047622&cbur=0.14550626106876674&cbtitle=&cbiframe=0&cbWidth=1536&cbHeight=864&cbdescription=&cbkeywords=&cbref=/ HTTP/1.1
Host: gotoadexchange.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 28 Mar 2024 10:21:15 GMT
content-type: text/html; charset=utf-8
location: https://gotoadexchange.com/script/i.php?t=1&c=23751586&stamat=m%257C%252C%252CAiLyo3MyoGU3B0-GH0dEdHP3xP.bab%252CN99cmomqYjZk9wgi1KeGoql9qej_vwL3lhJc9skqSe9-VxNe2qc-1lrNYKBjoy6-LDKr9gRLpHHNJ_mJwIxZeRUwL-bqXVS57eO3cSl45ywNAshWZG4lSfHhSghhouAl8u7vc-A8-hi_GmWILDEfuv4IRz-k0Re74xp2aYZYNWR869WvzvN84XnLRrVHPcv1TSNZqpNl_MQARBnK9CNvj2yQtxCHyk_2P181BbNXa7GUnl0QT7972TCqQp7HMq3R4ZApF0rhTQmwgjdKAUL8Kn0AxGawdyk2P2whR6kBi1BYZjRFUnmErUvOrNqiPuMcy3TYuue5UJLmqf4R4ICJk1z5_waZwOdimf80pmbr8SyQj0VHdVZiWnr1zv88z9qg0bsmY-StF6sxkTS9hK5sPqztX2YcN9fnfC3UoERrW7oFDiwnH9hdRqUB8DTXkq6usTDA6akUJOcyMT08bPGbNL_6oQwNecc_6RqvuI_mnYNk9wQwLe5hoMi5jJ1iyXUS5WV0BYPADum7RF65iExVwehJycAOHSSdMrepKAcDZqDPU_BHBls7wbJB3KU4z6EdjPW2Quj_wAT5DRmvHtm7rWl3SrVllfTkdzjdW33xVMY%252C
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type
via: 1.1 google
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NXIT3JFTaUdu1JZiuiauP%2B%2FWVrxh0TU1z%2BLVUfhzwr9u8G5nb1i58SQEMgJnmOZe6DZyppajVkzJCrdQBAzdn3HsVs42kA0UYRoj4kIEwGPH5bKPJ9Xp8g0X3%2FoPdjbqUINizcg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e46a5c0fb529-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

gotoadexchange.com/script/i.php?t=1&c=23751586&stamat=m%257C%252C%252CAiLyo3MyoGU3B0-GH0dEdHP3xP.bab%252CN99cmomqYjZk9wgi1KeGoql9qej_vwL3lhJc9skqSe9-VxNe2qc-1lrNYKBjoy6-LDKr9gRLpHHNJ_mJwIxZeRUwL-bqXVS57eO3cSl45ywNAshWZG4lSfHhSghhouAl8u7vc-A8-hi_GmWILDEfuv4IRz-k0Re74xp2aYZYNWR869WvzvN84XnLRrVHPcv1TSNZqpNl_MQARBnK9CNvj2yQtxCHyk_2P181BbNXa7GUnl0QT7972TCqQp7HMq3R4ZApF0rhTQmwgjdKAUL8Kn0AxGawdyk2P2whR6kBi1BYZjRFUnmErUvOrNqiPuMcy3TYuue5UJLmqf4R4ICJk1z5_waZwOdimf80pmbr8SyQj0VHdVZiWnr1zv88z9qg0bsmY-StF6sxkTS9hK5sPqztX2YcN9fnfC3UoERrW7oFDiwnH9hdRqUB8DTXkq6usTDA6akUJOcyMT08bPGbNL_6oQwNecc_6RqvuI_mnYNk9wQwLe5hoMi5jJ1iyXUS5WV0BYPADum7RF65iExVwehJycAOHSSdMrepKAcDZqDPU_BHBls7wbJB3KU4z6EdjPW2Quj_wAT5DRmvHtm7rWl3SrVllfTkdzjdW33xVMY%252C

104.21.62.156

302 Found

52 kB

URL User Request GET HTTP/2
gotoadexchange.com/script/i.php?t=1&c=23751586&stamat=m%257C%252C%252CAiLyo3MyoGU3B0-GH0dEdHP3xP.bab%252CN99cmomqYjZk9wgi1KeGoql9qej_vwL3lhJc9skqSe9-VxNe2qc-1lrNYKBjoy6-LDKr9gRLpHHNJ_mJwIxZeRUwL-bqXVS57eO3cSl45ywNAshWZG4lSfHhSghhouAl8u7vc-A8-hi_GmWILDEfuv4IRz-k0Re74xp2aYZYNWR869WvzvN84XnLRrVHPcv1TSNZqpNl_MQARBnK9CNvj2yQtxCHyk_2P181BbNXa7GUnl0QT7972TCqQp7HMq3R4ZApF0rhTQmwgjdKAUL8Kn0AxGawdyk2P2whR6kBi1BYZjRFUnmErUvOrNqiPuMcy3TYuue5UJLmqf4R4ICJk1z5_waZwOdimf80pmbr8SyQj0VHdVZiWnr1zv88z9qg0bsmY-StF6sxkTS9hK5sPqztX2YcN9fnfC3UoERrW7oFDiwnH9hdRqUB8DTXkq6usTDA6akUJOcyMT08bPGbNL_6oQwNecc_6RqvuI_mnYNk9wQwLe5hoMi5jJ1iyXUS5WV0BYPADum7RF65iExVwehJycAOHSSdMrepKAcDZqDPU_BHBls7wbJB3KU4z6EdjPW2Quj_wAT5DRmvHtm7rWl3SrVllfTkdzjdW33xVMY%252C
IP
104.21.62.156:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectgotoadexchange.com
Fingerprint18:99:88:5D:65:C6:02:E1:5F:94:CA:2A:9B:82:49:97:A5:37:F6:23
ValidityTue, 19 Mar 2024 13:41:39 GMT - Mon, 17 Jun 2024 13:41:38 GMT

File type

Size
52 kB (52269 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /script/i.php?t=1&c=23751586&stamat=m%257C%252C%252CAiLyo3MyoGU3B0-GH0dEdHP3xP.bab%252CN99cmomqYjZk9wgi1KeGoql9qej_vwL3lhJc9skqSe9-VxNe2qc-1lrNYKBjoy6-LDKr9gRLpHHNJ_mJwIxZeRUwL-bqXVS57eO3cSl45ywNAshWZG4lSfHhSghhouAl8u7vc-A8-hi_GmWILDEfuv4IRz-k0Re74xp2aYZYNWR869WvzvN84XnLRrVHPcv1TSNZqpNl_MQARBnK9CNvj2yQtxCHyk_2P181BbNXa7GUnl0QT7972TCqQp7HMq3R4ZApF0rhTQmwgjdKAUL8Kn0AxGawdyk2P2whR6kBi1BYZjRFUnmErUvOrNqiPuMcy3TYuue5UJLmqf4R4ICJk1z5_waZwOdimf80pmbr8SyQj0VHdVZiWnr1zv88z9qg0bsmY-StF6sxkTS9hK5sPqztX2YcN9fnfC3UoERrW7oFDiwnH9hdRqUB8DTXkq6usTDA6akUJOcyMT08bPGbNL_6oQwNecc_6RqvuI_mnYNk9wQwLe5hoMi5jJ1iyXUS5WV0BYPADum7RF65iExVwehJycAOHSSdMrepKAcDZqDPU_BHBls7wbJB3KU4z6EdjPW2Quj_wAT5DRmvHtm7rWl3SrVllfTkdzjdW33xVMY%252C HTTP/1.1
Host: gotoadexchange.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 28 Mar 2024 10:21:15 GMT
content-type: text/html; charset=utf-8
location: https://v.bondagani.org/base.php?c=5&key=3ff2940912f3f064a7449328c657870d&zone=6808846-0-1048998251&redcost=&clkid=171162127510000TNOTV415326358024Vd9&ban=23751586
access-control-allow-origin: *
via: 1.1 google
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pzCHhIs9bSouP%2BK77Nbc1pkpUM4n%2BMPRh2pBxo82VYSQxFZJe%2FbqcKk9v0rAvZQJPjT2T%2F6XSr1PZLNcF9aBIt23of4xIFwTR4bm0Me7MsVldw5IStw65EedtzIa%2Bj85TZAFYPs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e46b7d0bb529-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

thotslive.xyz/lowla/video/video.mp4

104.21.75.150

206 Partial Content

1.1 MB

URL GET HTTP/3
thotslive.xyz/lowla/video/video.mp4
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
ISO Media, Apple iTunes Video (.M4V) Video
Size
1.1 MB (1102963 bytes)
Hash
4de68bd4420412e7cec11eefb3f734da
466bb4dca6145dea5d48f9414139db9063d9a9e8
8361ff3349901260347628b612b6c812a09d85da99cc2fbc12d698be51d6ac08

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/video/video.mp4 HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 206 Partial Content
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: video/mp4
content-length: 1102963
last-modified: Wed, 25 Oct 2023 20:28:27 GMT
etag: "10d473-608904c3fa1c6"
cache-control: max-age=14400
cf-cache-status: HIT
age: 5698
content-range: bytes 0-1102962/1102963
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mHZr%2FlkTuBHeBAvZlRKnpUJLdBZppk2Iuyd%2FwL%2BOH50XX0vpNVwaknh10Pcq%2BQ6lHIKYBZ86xDU6p3h8q0Ay4Eue91yJOrpQQPJvN%2BSH1yFIXptiB4VV0%2BiE1vXEP25p"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b6e474fdcc0b49-OSL
alt-svc: h3=":443"; ma=86400

thotslive.xyz/lowla/video/video.mp4

104.21.75.150

206 Partial Content

1.1 MB

URL GET HTTP/3
thotslive.xyz/lowla/video/video.mp4
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Requested by
https://thotslive.xyz/lowla/index.html
Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type
ISO Media, Apple iTunes Video (.M4V) Video
Size
1.1 MB (1102963 bytes)
Hash
4de68bd4420412e7cec11eefb3f734da
466bb4dca6145dea5d48f9414139db9063d9a9e8
8361ff3349901260347628b612b6c812a09d85da99cc2fbc12d698be51d6ac08

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/video/video.mp4 HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://thotslive.xyz/lowla/index.html
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 206 Partial Content
date: Thu, 28 Mar 2024 10:21:17 GMT
content-type: video/mp4
content-length: 1102963
last-modified: Wed, 25 Oct 2023 20:28:27 GMT
etag: "10d473-608904c3fa1c6"
cache-control: max-age=14400
cf-cache-status: HIT
age: 5699
content-range: bytes 0-1102962/1102963
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6i7r%2BcqN65x8qTM7eMY%2BqO15%2BSi2FoWsG3FolhoS7sWRW1D%2BlwH1BU6Ro5GoTekjmxUjxfs88QcMpaPVP2tsLBbV%2F1y00EiQeBwFdlajpFRECbfOprFA%2Fzzx6Jij7H9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 86b6e475ae420b49-OSL
alt-svc: h3=":443"; ma=86400

thotslive.xyz/lowla/index.html

104.21.75.150

200 OK

52 kB

URL User Request GET HTTP/2
thotslive.xyz/lowla/index.html
IP
104.21.75.150:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectthotslive.xyz
FingerprintFC:D3:F4:68:24:9B:27:C7:90:0F:60:D1:15:5A:48:77:91:6D:F7:32
ValidityTue, 20 Feb 2024 19:13:11 GMT - Mon, 20 May 2024 19:13:10 GMT

File type

Size
52 kB (52269 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lowla/index.html HTTP/1.1
Host: thotslive.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 10:21:16 GMT
content-type: text/html
last-modified: Wed, 25 Oct 2023 20:28:26 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5PsfbxlzRtjrx05NEMNDKT0LPBDms1vAJss%2B0mKbEXG2LdY1eBpdRwDTvcxIbI6yNr%2BIfvKvlKxYoWVTeKq7%2BBiwUbLkWpf85stkMFiichyhsIGNkg272Z4bcsOUB%2FnH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86b6e470ab2f0b06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (14)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate