| fly.wrensongmobi.com/click?pid=3554&offer_id=86753&sub2=6796e9e07b5c2e0001b18036&sub5=u220871 |  188.114.97.1 | 302 Found | 0 B |
URL fly.wrensongmobi.com/click?pid=3554&offer_id=86753&sub2=6796e9e07b5c2e0001b18036&sub5=u220871 IP188.114.97.1:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?pid=3554&offer_id=86753&sub2=6796e9e07b5c2e0001b18036&sub5=u220871 HTTP/1.1
Host: fly.wrensongmobi.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Mon, 27 Jan 2025 02:05:35 GMT
content-length: 0
location: https://cpa.gbengene.com/click?pid=1373&offer_id=78348&sub5=3554_u220871&sub3=86753&sub4=%5BSOI-Sweeps%5D+US+-+trendndaily+-+Get+iPhone+16+Pro
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HYd4sO5VWJi%2FPiXToURXA911gbKKiyBlJGjp3EB7BMe43vnE6U%2BpXe5V0atmuZR%2B1zJIr1FWU7LPStFxjwDJHBgU0UJLaMpkYqjraSHkacmo0xnR1QCEH0WfZ8TtoBSN9KCvG%2BTDpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 90852db5fed3b518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5749&min_rtt=488&rtt_var=10543&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3211&recv_bytes=1173&delivery_rate=8337811&cwnd=254&unsent_bytes=0&cid=34b44d78ff63e3db&ts=97&x=0"
X-Firefox-Spdy: h2
|
|
| cpa.gbengene.com/click?pid=1373&offer_id=78348&sub5=3554_u220871&sub3=86753&sub4=%5BSOI-Sweeps%5D+US+-+trendndaily+-+Get+iPhone+16+Pro |  34.90.81.51 | 302 Found | 0 B |
URL cpa.gbengene.com/click?pid=1373&offer_id=78348&sub5=3554_u220871&sub3=86753&sub4=%5BSOI-Sweeps%5D+US+-+trendndaily+-+Get+iPhone+16+Pro IP34.90.81.51:0 ASN#396982 GOOGLE-CLOUD-PLATFORM
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /click?pid=1373&offer_id=78348&sub5=3554_u220871&sub3=86753&sub4=%5BSOI-Sweeps%5D+US+-+trendndaily+-+Get+iPhone+16+Pro HTTP/1.1
Host: cpa.gbengene.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Mon, 27 Jan 2025 02:05:35 GMT
content-length: 0
location: https://taco.viblix.link/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_u220871&cid=6796e9ef045e9f0001e5632f
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
set-cookie: afclick=6796e9ef045e9f0001e5632f; expires=Tue, 27 Jan 2026 02:05:35 GMT; secure; SameSite=None
afoffers={"78348":1737943535}; expires=Tue, 27 Jan 2026 02:05:35 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494 |  51.68.85.158 | 200 OK | 4.3 kB |
URL www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494 IP51.68.85.158:0
File typeHTML document, ASCII text, with very long lines (3463) Hash3412dae49a5d536abaadc4122b14a9ed 4816c82f5e1a2bc082fd0d5a11ac96129781d5c6 d7c1cd81372262f78cf278a3aac5124a9ef95d56cc8d1e5b5fd45d1b7b5444d2
GET /?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494 HTTP/1.1
Host: www.worlsmatic.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://taco.viblix.link/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 27 Jan 2025 02:05:36 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-transform
Accept-CH: Sec-CH-UA-Platform-Version
|
|
| www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=cb92ca6d07ef40f49c34b7e4b78f623a&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link | 51.68.85.158 | 302 Found | 0 B |
URL www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=cb92ca6d07ef40f49c34b7e4b78f623a&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link IP51.68.85.158:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=cb92ca6d07ef40f49c34b7e4b78f623a&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link HTTP/1.1
Host: www.worlsmatic.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Mon, 27 Jan 2025 02:05:36 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=3&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link
|
|
| www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=3&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link | 51.68.85.158 | 302 Found | 0 B |
URL www.worlsmatic.work/?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=3&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link IP51.68.85.158:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?sl=5887661-438d1&pub_click_id=M7464410645136408639&site=15494-14898560&pub_sub_id=15494&eyeg=3&eyer=0.21566726541535475&eyei=0&eyew=1280&eyeh=1024&eyetd=220&eyef=taco.viblix.link HTTP/1.1
Host: www.worlsmatic.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Mon, 27 Jan 2025 02:05:36 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://uip.shmuckgreen.live/?utm_medium=e1d8b36078fcfd93a2a4691ef17e00daab56fa70&utm_campaign=asl&cid=3977541938706132781&1=trk1_asl_NO
|
|
| www.worlsmatic.work/favicon.ico | 51.68.85.158 | 204 No Content | 0 B |
URL www.worlsmatic.work/favicon.ico IP51.68.85.158:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: www.worlsmatic.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 204 No Content
Date: Mon, 27 Jan 2025 02:05:36 GMT
Connection: keep-alive
|
|
| appvmstore.appvm.store/2c8047c4-066e-4834-a1b5-360c8c138f20?partner_id=27455&click_cost=0&subid=M7464410653726343178 |  54.240.174.57 | 302 Found | 0 B |
URL User Request GET HTTP/2appvmstore.appvm.store/2c8047c4-066e-4834-a1b5-360c8c138f20?partner_id=27455&click_cost=0&subid=M7464410653726343178 IP54.240.174.57:443
CertificateIssuerAmazon Subjectappvmstore.appvm.store Fingerprint38:0A:7F:8B:5C:73:04:4F:16:9D:C8:05:E0:94:FB:D6:52:BC:12:BD ValidityTue, 07 May 2024 00:00:00 GMT - Thu, 05 Jun 2025 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /2c8047c4-066e-4834-a1b5-360c8c138f20?partner_id=27455&click_cost=0&subid=M7464410653726343178 HTTP/1.1
Host: appvmstore.appvm.store
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uip.shmuckgreen.live/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-length: 0
location: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
date: Mon, 27 Jan 2025 02:05:37 GMT
server: nginx
cache-control: no-store, no-cache, pre-check=0, post-check=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
set-cookie: 2c8047c4-066e-4834-a1b5-360c8c138f20-v4=LtdjPrSsyA95x-L4FWiQVFTwV_wY6HXuEyCjZaiQUnk; Max-Age=86400; Expires=Tue, 28 Jan 2025 02:05:37 GMT; Domain=appvmstore.appvm.store; Path=/; Secure; HttpOnly;SameSite=None
cc-v4=8dxyAPm7m2Uz4achXHAKV2RPWG17nXotgw87mKeXH87ihixvMSEGtzOIM91X0qZ827UTBLVoZKdAgLAgj1zCBD3TXsykw1oMLRqVTRteenCq498uOgNTPVrbtQmUspg4MRpkJWkGa3vleE%2B2qWrKJQ%3D%3D; Max-Age=31536000; Expires=Tue, 27 Jan 2026 02:05:37 GMT; Domain=appvmstore.appvm.store; Path=/; Secure; HttpOnly;SameSite=None
x-cache: Miss from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: CWnaG9aq1i6uBNkW3Jl2mkhmg5baXdEu1000p5xVG7c4Mn1SHGT2fg==
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs |  185.155.184.43 | 200 OK | 7.7 kB |
URL User Request GET HTTP/2xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs IP185.155.184.43:443
CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeHTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (561), with CRLF line terminators Hash8a2bb0e8d3a99a5fd8f4e74729d0c854 98dadd09d820ff05bb8d52c96f052d12af0ab29c b0ea4d5bb2b61d05eb1f037ef782836bdbd3a2214177f3c16d95d89351c04496
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://uip.shmuckgreen.live/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/html
content-length: 7723
set-cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no; path=/
cache-control: private, no-transform
X-Firefox-Spdy: h2
|
|
| uip.shmuckgreen.live/?utm_medium=e1d8b36078fcfd93a2a4691ef17e00daab56fa70&utm_campaign=asl&cid=3977541938706132781&1=trk1_asl_NO | 67.212.184.150 | 200 OK | 5.8 kB |
URL uip.shmuckgreen.live/?utm_medium=e1d8b36078fcfd93a2a4691ef17e00daab56fa70&utm_campaign=asl&cid=3977541938706132781&1=trk1_asl_NO IP67.212.184.150:0
File typegzip compressed data, from Unix Hash1fd96bbaa047486b42d5501c7e5933ba eb760a16d01f5252ff9c5c02f6716c758793b6cc d4711b906e5074b502a8c7d878220a7d3ab686db96f12af21ddfe5e43f1fcd45
GET /?utm_medium=e1d8b36078fcfd93a2a4691ef17e00daab56fa70&utm_campaign=asl&cid=3977541938706132781&1=trk1_asl_NO HTTP/1.1
Host: uip.shmuckgreen.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Jan 2025 02:05:37 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=604800; persist=1
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/cookie/js.cookie11.js | 185.155.184.43 | 200 OK | 4.2 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/cookie/js.cookie11.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJavaScript source, ASCII text, with very long lines (1709), with CRLF line terminators Hashd69ea699f15818eb39d4f4898f75a7e3 0209181a1da02eaf3857d30efd7092ea85f4c7eb 1d6379dcee88d76c4895ef26cc84e178b995e0a8e1effc943691fe9c59ccdb60
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cookie/js.cookie11.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: application/javascript
content-length: 4157
etag: "d69ea699f15818eb39d4f4898f75a7e3"
last-modified: Wed, 31 Aug 2022 09:31:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c
x-amz-request-id: 181E691259F9CE63
x-content-type-options: nosniff
x-ratelimit-limit: 374
x-ratelimit-remaining: 374
x-xss-protection: 1; mode=block
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/util/utils.js | 185.155.184.43 | 200 OK | 7.5 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/util/utils.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJavaScript source, ASCII text, with very long lines (641), with CRLF line terminators Hash67f83bb8309524daa942af9cec436419 df63410e039476a6dde6eb4200b5c1666c52af21 57d2fd3a46ef70b606d7dcd83f70b6a2107725cd910ca1399c70ef52b2c72b9d
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /util/utils.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/javascript
content-length: 7514
etag: "67f83bb8309524daa942af9cec436419"
last-modified: Thu, 16 Jan 2025 07:55:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c
x-amz-request-id: 181E69FB67F1BB35
x-content-type-options: nosniff
x-ratelimit-limit: 374
x-ratelimit-remaining: 374
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1737013493#205481014/gid:0/gname:root/mode:33188/mtime:1737014112#757470179/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2025-01-16T07:55:12.806Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/girl.png | 185.155.184.43 | 200 OK | 20 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/girl.png IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typePNG image data, 320 x 352, 8-bit colormap, non-interlaced Hash3e9715aca14895be6809d18ee806d561 584fb439c7a6c3d9ac2cda1f3ee24212546d316c 5c30263d90e5109b19aec665afcf22292bff66fd158c31e34c08de212e14ecb7
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/girl.png HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/png
content-length: 20415
etag: "3e9715aca14895be6809d18ee806d561"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E693503D38CD1
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#508449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.508449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/body1_o.jpg | 185.155.184.43 | 200 OK | 9.4 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/body1_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash85ccecbbf23425d18c7c012f7341ce27 7317eda85c061ee60c072d89fe407f37c26c0d1e 1b10dd2a543fef61a4a61836377e5461b57c95dd95d12f1e35c57b26d7edf834
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/body1_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 9351
etag: "85ccecbbf23425d18c7c012f7341ce27"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: af968cfc53e5d4d46c2a7314ea3774fe010d1d1a8defca6495a09901b4f201c0
x-amz-request-id: 181E69350DE11EF4
x-content-type-options: nosniff
x-ratelimit-limit: 336
x-ratelimit-remaining: 336
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#176448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.176448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/body2_o.jpg | 185.155.184.43 | 200 OK | 7.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/body2_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash25ead115fd19de86d001b9ea0e530b98 2f87b29630774c703ddd5b3f63c598099741589c 3b654731702ea10a66129af5b97f7dad0db5f60ef6ee0960ce99b7bf9ee6face
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/body2_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7139
etag: "25ead115fd19de86d001b9ea0e530b98"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E6935041A89D2
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#236448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.236448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/body3_o.jpg | 185.155.184.43 | 200 OK | 7.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/body3_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash25f4616348a1f5076ddaaf43b8be0d99 1ebb536691f648bcfc91b6e0e8e7b0de099873d9 a738b84f2486de67b74a3ce03617e248b592b3e316bc9ad5b471f13e29924210
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/body3_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7115
etag: "25f4616348a1f5076ddaaf43b8be0d99"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 31f7dd36b65146a775b93356924fa83cf99019d4a4dfda4a9a6512d5179fdf9c
x-amz-request-id: 181E69350E07A692
x-content-type-options: nosniff
x-ratelimit-limit: 374
x-ratelimit-remaining: 374
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#296448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.296448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/body4_o.jpg | 185.155.184.43 | 200 OK | 4.7 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/body4_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash6bfe731b38785116e374e8afd448473b ce318d0506e12cb3f373b791e78fb60c183e6366 f64c0ecdf9c70f46bbd9a30de7d9b7eba62730b88084543d31037eace2807a68
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/body4_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 4708
etag: "6bfe731b38785116e374e8afd448473b"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E693504601061
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#356448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.356448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/body5_o.jpg | 185.155.184.43 | 200 OK | 7.4 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/body5_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash67c337328ace4aa7c94fbcadbb997963 19ecc8595ff083a870598689b85713014b9941b4 ab5b0cdc771fbee94ae961621de091469cd6d3ee9e0345d67fea8790f47ef21b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/body5_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7402
etag: "67c337328ace4aa7c94fbcadbb997963"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 5bbf9b091ca9dd795595b773b0f1d036407937e2098457815217f1ddbc67c996
x-amz-request-id: 181E69350E2CCB47
x-content-type-options: nosniff
x-ratelimit-limit: 343
x-ratelimit-remaining: 343
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#420448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.420448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/age1_o.jpg | 185.155.184.43 | 200 OK | 6.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/age1_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash412c98a48bd4e5f3095860f53e2fab25 f06ffecbc1f132beb4ec81a149cc79cb5b78559b 1e26c71724f0061870300be2d22c080c376f3189783e4b07f13e9457b9ace154
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/age1_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 6051
etag: "412c98a48bd4e5f3095860f53e2fab25"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E6935049D5F57
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386485#852447000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.852447Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/js/main.js | 185.155.184.43 | 200 OK | 420 B |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/js/main.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJavaScript source, ASCII text, with CRLF line terminators Hasha322e0dcdf76f9882705b9a89f6b082b ae7fdfa0eeea832c78bb544dbdbf3083388fe4af 1dffa6552d41bc82dfb6eb89f3e0f950a9eb786ac4b742ba53e371c2a63b618c
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/js/main.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/javascript
content-length: 420
etag: "a322e0dcdf76f9882705b9a89f6b082b"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 5bbf9b091ca9dd795595b773b0f1d036407937e2098457815217f1ddbc67c996
x-amz-request-id: 181E693510DF5948
x-content-type-options: nosniff
x-ratelimit-limit: 343
x-ratelimit-remaining: 343
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1719825141#65486639/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-07-01T09:12:21.065486639Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/js/trls.js | 185.155.184.43 | 200 OK | 26 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/js/trls.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeUnicode text, UTF-8 text, with CRLF line terminators Hashb95c4acdfea813fa155e49dc8d45f0b0 9d837ba97dd18929d6ed33acc27bf9824be5caa1 4e9a4e9bbcc045f6082f234bc330cb42e24f139a44f9e329f8b41d1688accec1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/js/trls.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/javascript
content-length: 26041
etag: "b95c4acdfea813fa155e49dc8d45f0b0"
last-modified: Mon, 01 Jul 2024 09:12:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E693505F87F0D
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1715611635#597340946/gid:0/gname:root/mode:33188/mtime:1719825141#117486747/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-07-01T09:12:21.172Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/bbc.js | 185.155.184.43 | 200 OK | 1.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/bbc.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeASCII text, with CRLF line terminators Hash57e25a20c9962ce9c7077e46c69a265f cba5f15234d9059feacd95fe60fcd7165b45295b 329ed89ce6841f591a258c691e89ca2a55d0c8f481a7ba7c167df8f8198f2791
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/bbc.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: application/javascript
content-length: 1132
etag: "57e25a20c9962ce9c7077e46c69a265f"
last-modified: Mon, 20 Feb 2023 09:29:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 5bbf9b091ca9dd795595b773b0f1d036407937e2098457815217f1ddbc67c996
x-amz-request-id: 181E696C3D7E80B7
x-content-type-options: nosniff
x-ratelimit-limit: 343
x-ratelimit-remaining: 343
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676832256#258761277/gid:0/gname:root/mode:33188/mtime:1659030913#968764000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-28T17:55:13.968764Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/js/jquery-1.11.1.min.js | 185.155.184.43 | 200 OK | 96 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/js/jquery-1.11.1.min.js IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash612ce073e0525fda305524a4a9949587 a87a1ec66b4a404b2f793f2de9f806955e8952cf a181a613a6eeab77259b1d6537f82fd28f4cb38fa41e43af8d1677a3542e74bf
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/js/jquery-1.11.1.min.js HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/javascript
content-length: 95699
etag: "612ce073e0525fda305524a4a9949587"
last-modified: Mon, 01 Jul 2024 09:12:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E693505CD8B8F
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1719825141#213486942/gid:0/gname:root/mode:33188/mtime:1719825141#161486837/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2024-07-01T09:12:21.217Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/age2_o.jpg | 185.155.184.43 | 200 OK | 9.5 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/age2_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hashbdee974dfa1bd0381fb37d21c6a24d2b 71c58820bdcd2353850aa2efdf9bcf707198673b 0e9ec0e7494a79661fe5644cda9c4d6c5fe12260606ad1f3ba8105cb953d830b
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/age2_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 9472
etag: "bdee974dfa1bd0381fb37d21c6a24d2b"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 42aa5a63a589b4374a9c1295fb1c20dcda18b77f2cb8e112e03c5ecdf9b92360
x-amz-request-id: 181E693510077D37
x-content-type-options: nosniff
x-ratelimit-limit: 336
x-ratelimit-remaining: 336
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386485#916447000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.916447Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/age3_o.jpg | 185.155.184.43 | 200 OK | 7.7 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/age3_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash47f8432cca02f63b701c2999eeea43ba 56d51f3b5039c7e60ad400f17e123a5dff714304 3cf09326ff416c5f53d81127aca350009110721c6ea1e879a363d71018bf2b88
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/age3_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7696
etag: "47f8432cca02f63b701c2999eeea43ba"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E693504E4F4F4
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386485#980447000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.980447Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/age4_o.jpg | 185.155.184.43 | 200 OK | 6.9 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/age4_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash7d81b6b005bf4b955b5e6297172c5a8d 0bae48d0799d12602b3166a19472e1db6fedc248 d4c8c2b2cc9bf5d502fc17d4f83ca73c4c9cbfbdff6624b3d00ba2e05f3efe94
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/age4_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 6924
etag: "7d81b6b005bf4b955b5e6297172c5a8d"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 354f9eb41c4f44111da43ee93430d467ccc8f740dac6a89f93d2690a13b4c5b4
x-amz-request-id: 181E69351008ECA9
x-content-type-options: nosniff
x-ratelimit-limit: 365
x-ratelimit-remaining: 365
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#44448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.044448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/age5_o.jpg | 185.155.184.43 | 200 OK | 7.2 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/age5_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash7f23ba7584e5f2f5f5bc1129a7a21492 141963c0678f4591441797f99a45a03616f5c8fb a3f7fb4399ca65391f898e2346c079e1706165a02c04db92babe675b5cdeb490
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/age5_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7158
etag: "7f23ba7584e5f2f5f5bc1129a7a21492"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E6935051F2B6F
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#108448000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.108448Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations1_o.jpg | 185.155.184.43 | 200 OK | 9.6 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations1_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash974ca1664d2cea320c17179302d33d4e dc48c7bc4b20d281f190ff2ad5579df2f853864e a66348a7dfa7072dedec904d8069b573678ca9bb73168170ed010640ef929af1
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/relations1_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 9613
etag: "974ca1664d2cea320c17179302d33d4e"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 42aa5a63a589b4374a9c1295fb1c20dcda18b77f2cb8e112e03c5ecdf9b92360
x-amz-request-id: 181E6935101A7796
x-content-type-options: nosniff
x-ratelimit-limit: 336
x-ratelimit-remaining: 335
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#568449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.568449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations2_o.jpg | 185.155.184.43 | 200 OK | 9.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations2_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash90448128e70479a071e70b19b0f8b187 4a4e5f480b8df6e6fa4fd1ce2579a7eb33afdaf6 ca08d85836df6ab8247acd0df5c027ec6e5d63fd436b9ebef5769fae98252638
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/relations2_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 9079
etag: "90448128e70479a071e70b19b0f8b187"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E69350569700D
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#632449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.632449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations3_o.jpg | 185.155.184.43 | 200 OK | 9.4 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations3_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hash4d3d38adf2f0ce332b20112bd35cd8bf 6b4c3de36268a2459f4970779ab51efbf5b5ccf5 2f824639869c4c24dc402ace4994ff5e628f7a48dd39dc5598ce36136f26719f
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/relations3_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 9360
etag: "4d3d38adf2f0ce332b20112bd35cd8bf"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 5bbf9b091ca9dd795595b773b0f1d036407937e2098457815217f1ddbc67c996
x-amz-request-id: 181E6935101CE40A
x-content-type-options: nosniff
x-ratelimit-limit: 343
x-ratelimit-remaining: 343
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#692449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.692449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations4_o.jpg | 185.155.184.43 | 200 OK | 7.5 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations4_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hashb3160168c65670576b0c54f6ef80c972 4b4c73fea6466f0733dbe55b7b60d0fa5b05ccd7 d26ed7a1ce5bc3a33d1d88b0b04c0c7ee156c59149af8409eb308581eea87f45
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/relations4_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 7546
etag: "b3160168c65670576b0c54f6ef80c972"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E6935059FB65A
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386486#752449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.752449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations5_o.jpg | 185.155.184.43 | 200 OK | 8.3 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/images/relations5_o.jpg IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 220x220, components 3 Hashc8977e9f072bac461be435c71ffd01d0 f13fbff743f380f87271d37af099e83ad8186e61 ad74a6271b89a55e3df1ec7dfd3c938024b701b0d5ef3bf939793e30b8100bf8
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/images/relations5_o.jpg HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: image/jpeg
content-length: 8333
etag: "c8977e9f072bac461be435c71ffd01d0"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 5bbf9b091ca9dd795595b773b0f1d036407937e2098457815217f1ddbc67c996
x-amz-request-id: 181E69351027DC93
x-content-type-options: nosniff
x-ratelimit-limit: 343
x-ratelimit-remaining: 342
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386486#816449000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:46.816449Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/fonts/QuattrocentoSans.ttf | 185.155.184.43 | 200 OK | 78 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/fonts/QuattrocentoSans.ttf IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeTrueType Font data, 16 tables, 1st "GPOS", 7 names, Microsoft, language 0x409, type 1 string, Quattrocento SansRegularPabloImpallari,IginoMarini,BrendaGallo: Quattrocento Sans: 2011Version 2 Hashce091a3d610240f8ea45c336266b5792 240eb69d6e901909208105620256e0871ef9737f 8a1e4d8cb32309d03e754bbff5cf0dea8cb14973a0a650c1cb58b8592f5da13a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/fonts/QuattrocentoSans.ttf HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/media/casual/toon3/css/style_alt.css
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: font/ttf
content-length: 78036
etag: "ce091a3d610240f8ea45c336266b5792"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 42aa5a63a589b4374a9c1295fb1c20dcda18b77f2cb8e112e03c5ecdf9b92360
x-amz-request-id: 181E6A312B789AF4
x-content-type-options: nosniff
x-ratelimit-limit: 336
x-ratelimit-remaining: 336
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386485#660447000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.660447Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/fonts/QuattrocentoSansBold.ttf | 185.155.184.43 | 200 OK | 80 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/fonts/QuattrocentoSansBold.ttf IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeTrueType Font data, 16 tables, 1st "GPOS", 7 names, Microsoft, language 0x409, type 1 string, Quattrocento SansBoldPabloImpallari,IginoMarini,BrendaGallo: Quattrocento Sans Bold: 2011Quattro Hashb80c7c5dc4739cd94fbc56b2f57509c4 ae800186fbcf2c85b1d9f271b69455c8ad5c8f40 fc24aac0d90f109b21b91a1c7171a9e96cf056ac8eb888be2a9d3d35d35ac795
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/fonts/QuattrocentoSansBold.ttf HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/media/casual/toon3/css/style_alt.css
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: font/ttf
content-length: 79848
etag: "b80c7c5dc4739cd94fbc56b2f57509c4"
last-modified: Wed, 20 Sep 2023 15:21:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
x-amz-request-id: 181E6A312286B4CD
x-content-type-options: nosniff
x-ratelimit-limit: 1988
x-ratelimit-remaining: 1988
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134504#780010470/gid:0/gname:root/mode:33188/mtime:1655386485#792447000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.792447Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/favicon.ico | 185.155.184.43 | 204 No Content | 0 B |
URL GET HTTP/2xd622rk.your-thecasualdate.com/favicon.ico IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 204 No Content
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
cache-control: no-transform
X-Firefox-Spdy: h2
|
|
| taco.viblix.link/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_u220871&cid=6796e9ef045e9f0001e5632f | 108.178.23.116 | 200 OK | 9.5 kB |
URL taco.viblix.link/?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_u220871&cid=6796e9ef045e9f0001e5632f IP108.178.23.116:0
File typegzip compressed data, from Unix Hash5f8fc580824ff0d85ae885de00ca118e 6b31b86260a92ce5770d32ba3c30e598d44e54df 26bf62237291b64c0e94578b14ad8c19077109b3965ad140d4df24974083139c
GET /?utm_medium=04a36d53033249cb443c0269cf7ee2c9c2143472&utm_campaign=Main&1=1373_3554_u220871&cid=6796e9ef045e9f0001e5632f HTTP/1.1
Host: taco.viblix.link
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Mon, 27 Jan 2025 02:05:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
strict-transport-security: max-age=63072000; includeSubDomains; preload
alt-svc: h3=":443"; ma=604800; persist=1
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| xd622rk.your-thecasualdate.com/media/casual/toon3/css/style_alt.css | 185.155.184.43 | 200 OK | 5.1 kB |
URL GET HTTP/2xd622rk.your-thecasualdate.com/media/casual/toon3/css/style_alt.css IP185.155.184.43:443
Requested byhttps://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs CertificateIssuerLet's Encrypt Subjectyour-thecasualdate.com Fingerprint13:FF:F2:E9:98:52:A2:BF:9F:6E:79:01:DE:3D:77:27:6E:A4:90:98 ValidityTue, 17 Dec 2024 14:24:43 GMT - Mon, 17 Mar 2025 14:24:42 GMT
File typeASCII text, with very long lines (5909), with no line terminators Hash788efb1370100784c22bb875b4f5f8c0 b19e2ed39e2f9002c62aed2fd0c90ab32b0597b4 87002300091cc7150dbf45797d70f37a643ad1b9d8b6bfc9ddb659ff29e75b39
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /media/casual/toon3/css/style_alt.css HTTP/1.1
Host: xd622rk.your-thecasualdate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://xd622rk.your-thecasualdate.com/ghrp1ww?cid=wgclk3qvkrlthqa7jvm8hjfs&t=816de927-f2ed-4399-8bc8-e937d25b4216wgclk3qvkrlthqa7jvm8hjfs
Cookie: sid=t6~xvjsvhrtmhbmct1qcrbr53no
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: openresty
date: Mon, 27 Jan 2025 02:05:38 GMT
content-type: text/css
content-length: 5097
etag: "faef7172cb03c340a5df27533a002d1a"
last-modified: Thu, 01 Aug 2024 07:18:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin, Accept-Encoding
x-amz-id-2: 354f9eb41c4f44111da43ee93430d467ccc8f740dac6a89f93d2690a13b4c5b4
x-amz-request-id: 181E69350D554016
x-content-type-options: nosniff
x-ratelimit-limit: 365
x-ratelimit-remaining: 365
x-xss-protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1720014408#820173636/gid:0/gname:root/mode:33188/mtime:1655386485#244446000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:34:45.244446Z
expires: Tue, 27 Jan 2026 02:05:38 GMT
cache-control: max-age=31536000, no-transform
accept-ranges: bytes
X-Firefox-Spdy: h2
|
|