Overview

URL lysyfyj.com/ZUPdZ/login.php
IP95.211.219.67
ASNLeaseWeb Netherlands B.V.
Location Netherlands
Report completed2022-10-04 01:13:39 UTC
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blocklists

OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-10-04 2 lysyfyj.com/ZUPdZ/login.php Malware
2022-10-04 2 ww1.lysyfyj.com/ Malware
2022-10-04 2 ww1.lysyfyj.com/px.js?ch=1 Malware
2022-10-04 2 ww1.lysyfyj.com/px.js?ch=2 Malware
mnemonic secure dns
Scan Date Severity Indicator Comment
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
Quad9 DNS
Scan Date Severity Indicator Comment
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed
2022-10-04 2 lysyfyj.com Sinkholed


Files

No files detected



Passive DNS (10)

Passive DNS Source Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
mnemonic passive DNS push.services.mozilla.com (1) 2140 2015-09-03 10:29:36 UTC 2022-10-03 09:28:24 UTC 54.191.222.112
mnemonic passive DNS i1.cdn-image.com (10) 118639 2012-05-21 16:55:13 UTC 2022-10-03 19:58:48 UTC 23.36.76.113
mnemonic passive DNS firefox.settings.services.mozilla.com (2) 867 2020-05-27 20:08:30 UTC 2022-10-03 17:23:50 UTC 143.204.55.115
mnemonic passive DNS content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2022-10-03 08:07:24 UTC 143.204.55.110
mnemonic passive DNS lysyfyj.com (1) 0 2012-07-24 09:06:35 UTC 2022-09-30 01:30:38 UTC 95.211.219.67 Unknown ranking
mnemonic passive DNS ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2022-10-03 20:32:42 UTC 93.184.220.29
mnemonic passive DNS ww1.lysyfyj.com (5) 0 2018-09-29 22:18:01 UTC 2022-09-26 01:50:11 UTC 208.91.196.145 Unknown ranking
mnemonic passive DNS r3.o.lencr.org (5) 344 2020-12-02 08:52:13 UTC 2022-10-03 07:33:36 UTC 23.36.76.226
mnemonic passive DNS contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-10-03 09:28:24 UTC 34.117.237.239
mnemonic passive DNS img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2022-10-03 14:02:45 UTC 34.120.237.76


Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 95.211.219.67

Date UQ / IDS / BL URL IP
2022-11-28 03:01:57 +0000
0 - 0 - 5 blog.aresmusica.org/555 95.211.219.67
2022-11-23 20:46:22 +0000
0 - 0 - 14 qfs.ezdownloadpro.info/v1481?q=sugaring%20tim (...) 95.211.219.67
2022-11-18 02:57:15 +0000
0 - 0 - 1 livesportsol.com/team/tottenham-hotspur 95.211.219.67
2022-11-15 03:03:06 +0000
0 - 0 - 1 shannonrichards.com/pmmoz/login.php 95.211.219.67
2022-11-12 03:17:24 +0000
0 - 0 - 1 livesportsol.com/tag/bundesliga-20162017-week-14 95.211.219.67

Last 5 reports on ASN: LeaseWeb Netherlands B.V.

Date UQ / IDS / BL URL IP
2022-12-06 09:38:47 +0000
0 - 0 - 2 rasvetakandela.com/js/.ch/660e4be8f59ae4c3ab7 (...) 85.17.187.35
2022-12-06 09:31:02 +0000
0 - 0 - 1 gsuyffsi.nn.wy5532.com/ 37.48.65.149
2022-12-06 09:28:30 +0000
0 - 0 - 1 iuyuy.5691b.zs.wy5532.com/ 37.48.65.151
2022-12-06 07:48:34 +0000
0 - 0 - 1 yhxxe.ff.wy5532.com/ 81.171.22.4
2022-12-06 07:46:06 +0000
0 - 0 - 1 tycfebq.ee.wy5532.com/ 37.48.65.154

Last 5 reports on domain: lysyfyj.com

Date UQ / IDS / BL URL IP
2022-12-05 17:06:55 +0000
0 - 0 - 14 lysyfyj.com/pmmoz/login.php 5.79.79.210
2022-11-27 01:16:00 +0000
0 - 0 - 10 lysyfyj.com/pmmoz/login.php 95.211.117.215
2022-11-26 16:28:43 +0000
0 - 0 - 14 lysyfyj.com/zejyz/login.php 95.211.219.65
2022-11-26 01:50:57 +0000
0 - 0 - 14 lysyfyj.com/VSmNZ/login.php 95.211.219.66
2022-11-23 01:07:37 +0000
0 - 0 - 16 lysyfyj.com/ZejYZ/login.php 69.162.80.59

Last 5 reports with similar screenshot

Date UQ / IDS / BL URL IP
2022-11-08 01:17:29 +0000
0 - 0 - 16 lysyfyj.com/ZUPdZ/login.php 95.211.117.215
2022-09-20 01:07:47 +0000
0 - 0 - 16 lysyfyj.com/ZejYZ/login.php 69.162.80.51
2022-09-13 05:16:55 +0000
0 - 0 - 20 lysyfyj.com/NQXOZ/login.php 95.211.219.66
2022-10-11 21:43:22 +0000
0 - 0 - 8 cinemay.biz/ 81.171.22.6
2022-10-04 09:11:44 +0000
0 - 0 - 8 cinemay.biz/ 81.171.22.6


JavaScript

Executed Scripts (9)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (33)


Request Response
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Type, Alert, Backoff, Retry-After, Content-Length
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Tue, 04 Oct 2022 00:47:04 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 76c917e0bb0ba45eb834d25d76ee125e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: akF4p2hCPPvIdJpLG8G9mTVHXM8IBtCmG7nfQlvDlcSsgfc_i_VrPg==
Age: 1585


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    2d12f67fe57a87e7366b662d153a5582
Sha1:   d7b02d81cc74f24a251d9363e0f4b0a149264ec1
Sha256: 73c273c0b5a2de3cb970b8e8c187999d3b55e760dc7766dab4bb76428d19b551
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EB128AEC099DBF1919EE5D965221E904AD3A2162583683CEC44518640B505447"
Last-Modified: Sat, 01 Oct 2022 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7965
Expires: Tue, 04 Oct 2022 03:26:14 GMT
Date: Tue, 04 Oct 2022 01:13:29 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.110
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Mon, 03 Oct 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 83a23d85c009b0c0e3626072e9f997fe.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: iAIZNBYY65Br8c_gbHByuS7IQsqL0HtfIJQv_ryKkhfMJQ3pPBOc5g==
age: 71102
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    6113f8408c59aebe188d6af273b90743
Sha1:   7398873bf00f99944eaa77ad3ebc0d43c23dba6b
Sha256: b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
                                        
                                            GET /ZUPdZ/login.php HTTP/1.1 
Host: lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                         
                                         95.211.219.67
HTTP/1.1 302 Found
                                        
cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Tue, 04 Oct 2022 01:13:29 GMT
location: http://ww1.lysyfyj.com
server: nginx
set-cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47; path=/; domain=.lysyfyj.com; expires=Sun, 22 Oct 2090 04:27:36 GMT; max-age=2147483647; HttpOnly


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   11
Md5:    32682312d17c7cbf18e73594f5570319
Sha1:   60e22121bdd0bc71cdb2bae2a3aa577006b2eae9
Sha256: e55fb1a1d731153e943b68844af12dcce8bfac917c98ffdea64c80da0607dd47

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Tue, 04 Oct 2022 01:13:29 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         143.204.55.115
HTTP/1.1 200 OK
Content-Type: application/json
                                        
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Tue, 04 Oct 2022 00:29:33 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Tue, 04 Oct 2022 01:09:06 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: VC-S-RIQnyfpMMIVlnpo--gYX5C_SQ4NWQzrKMUeWeAH7vqXURFLdw==
Age: 2637


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 5793
Cache-Control: 'max-age=158059'
Date: Tue, 04 Oct 2022 01:13:30 GMT
Last-Modified: Mon, 03 Oct 2022 23:36:57 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: ww1.lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47
Upgrade-Insecure-Requests: 1

                                         
                                         208.91.196.145
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 01:13:30 GMT
Server: Apache
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_dpeNkBtuxYm/MBZs/bZeUU3s4/koLZ8CKRrVuExOAQCoG+Ba51AcHGx/+c/uadYGFJhrh38uGdoujyuOdbwbLg==
ntCoent-Length: 2030
Keep-Alive: timeout=5, max=126
Connection: Keep-Alive
Cache-Control: private
Content-Encoding: gzip
Content-Length: 935


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (439), with CRLF line terminators
Size:   935
Md5:    e72549b066fddf2bf8d2b34724a26f4b
Sha1:   a084cde3df4536895981edaa7464ae1b44740c5c
Sha256: 6198bf72f358ded267277b485df025912859fb0343a3f442bce678b998d0d4cc

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: IMSvflHFAcUZQzhsN5buDg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                         
                                         54.191.222.112
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: OtUivmCECKeLU3kFNJPfOeXRlZU=

                                        
                                            GET /favicon.ico HTTP/1.1 
Host: ww1.lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/
Cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47; isframesetenabled=1

                                         
                                         208.91.196.145
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
                                        
Date: Tue, 04 Oct 2022 01:13:30 GMT
Server: Apache
Referrer-Policy: no-referrer-when-downgrade
Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
ntCoent-Length: 10
Keep-Alive: timeout=5, max=124
Connection: Keep-Alive
Cache-Control: private
Content-Encoding: gzip
Content-Length: 30


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   30
Md5:    c4609c83d6054d974c265b208bdc2a21
Sha1:   7e963e7185900347babd1f2797312c0ca21fa4ae
Sha256: 6cd85e3008758f2e06eeff9efdf9b4ad2981f6654f87918d155b0aced68d959a

Alerts:
  Blocklists:
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6666
Expires: Tue, 04 Oct 2022 03:04:37 GMT
Date: Tue, 04 Oct 2022 01:13:31 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6666
Expires: Tue, 04 Oct 2022 03:04:37 GMT
Date: Tue, 04 Oct 2022 01:13:31 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6666
Expires: Tue, 04 Oct 2022 03:04:37 GMT
Date: Tue, 04 Oct 2022 01:13:31 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                         
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6666
Expires: Tue, 04 Oct 2022 03:04:37 GMT
Date: Tue, 04 Oct 2022 01:13:31 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: TVz3oiy-Z2r9lGFDgsnGNxotvvAPeOaa7LMzqs432QjZpZo-PNt1-g==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 04:42:51 GMT
age: 73840
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6315
Md5:    206fb65e75dbadf119512f71e0b78402
Sha1:   58ff0bf8ce7528b303d28bab01a80ad721705569
Sha256: 56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffd3966c4-a932-4eb5-a3bf-ca25cde92ccb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5317
x-amzn-requestid: 84ffe752-ae82-4fb6-9b29-9b69a3a3dcdf
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpHuGEjIAMF8Bw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5564-3717ba3f22da06bc791b20b6;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:34:28 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: uS3VqXlUimv6Ef0jk6sxGp4xrg7LxbU9w34IE5KF4boZwkkhv6qfAQ==
via: 1.1 1949caaabae48a894fcd770a3e1384f6.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:44:20 GMT
age: 12551
etag: "4d208807e10e73309811101ef2d26ff33b642585"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5317
Md5:    a0927f94dd9e0cc7272f77972048658c
Sha1:   4d208807e10e73309811101ef2d26ff33b642585
Sha256: 3f184d9ba1588d451dfe5e4dfd84456ce533cbccaf1390ad423e1c6d38c8a35b
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5d0984d7-fe4f-4f96-9f0f-17e0197a5cb6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5857
x-amzn-requestid: 51f3a938-30f6-418e-970b-439bdfbb7c2b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpHvHIAIAMF6PQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5564-6d97d5ff3c3589ee1e900a3b;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:34:28 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: OModa8qHXEimXsJhr1DiYifYbFLgI-yMvAaKZA2SsRyU1N5CWwoVOg==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 01147dcc35d57fc0238a3c1700c13f16.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 22:16:34 GMT
age: 10617
etag: "1d90e98d3666fc8618130eac15972d3a08addf16"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5857
Md5:    78caa2bb8e856110416bc85ed2420d20
Sha1:   1d90e98d3666fc8618130eac15972d3a08addf16
Sha256: 5175905bdbcd0a325ff666148a77503f14d1922d826ad14a9c3d09846d77dff5
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fec31ab6c-46f2-4d77-a807-9f14bb5073bc.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 11955
x-amzn-requestid: ce6bbe93-95b0-4b6e-a8bc-012796485e67
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Zcqb9FUtoAMF0WQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b577f-59dc0a18523f900a059aa5df;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:43:27 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 44jC1Ww19YUJjZHw9_3cSSR5Y7nw5df412G-RxWFTcbRz1XDKaT3zQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 b8c4a4ca04bb1976e020396d211bc8dc.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:44:35 GMT
age: 12536
etag: "e2ea2ef6805e391c497e62e101e76a0bdecfce64"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   11955
Md5:    54b3ef7aa50273b78b59c24511b0c1f9
Sha1:   e2ea2ef6805e391c497e62e101e76a0bdecfce64
Sha256: 296e8954022d5160137b3e02ab5085a15cee7c23cd6d4ca61b36880706062457
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8641c47a-9aff-4f73-bb07-6770cbbcc8d6.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5504
x-amzn-requestid: 37405eb0-5c75-46a9-84c0-e8ed726995d8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcpHvHPvoAMF3mg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b5564-77fd550b58af612525e74761;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:34:28 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: O1yNc4H21kixhUEE7099oNqs7a5ZnJBBjlZbsbmLvaXyzXzrK0dL3w==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 b36bf2c460ac693ce304817aed073112.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:44:33 GMT
age: 12538
etag: "20ef861be49c652a938e0145e4ca3a60159367e2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5504
Md5:    6c6882c60d7ca6f918c77104e3ad1d52
Sha1:   20ef861be49c652a938e0145e4ca3a60159367e2
Sha256: 861f5870990fbd2939d151ae18384cf311e87067ca9a50818efe0c2d51b83088
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F92e2742a-a49a-4d87-a767-7dbb56cff473.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                         
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6107
x-amzn-requestid: 6516bfcd-d6a5-4f46-81fa-ef6033e21aa7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZcqO7GXOoAMF8hQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633b572c-27fb158e152659380e27c292;Sampled=0
x-amzn-remapped-date: Mon, 03 Oct 2022 21:42:04 GMT
x-amz-cf-pop: SEA19-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: SVkRglRw_TkmAMN-8BydwiWrLcFxpaR9hPsG7OjvGN5KtxteTiVYlw==
via: 1.1 7514e5e25722778fd4b1744d4ecc67e0.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 21:44:30 GMT
age: 12541
etag: "291232594a2f3170afed3b4814e3a11233d0f05e"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6107
Md5:    1f0977129995c466e4710e0ae4304d3e
Sha1:   291232594a2f3170afed3b4814e3a11233d0f05e
Sha256: 80927a148dff4908b799b9f6d167769e68346491092520f5e3638b0f8b5d55a3
                                        
                                            GET /px.js?ch=1 HTTP/1.1 
Host: ww1.lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZcCmydjcqnBcAL0PeB8S9EhNRxT8H7qsJVpd8YVmJ6fBIEyQj%2Fpqmc5eGBAGG7pixLB8vpcxLVsprTT1E3L5pjSxju%2BWJUgu94oxvOyn3Kt8nty%2F%2BxeKecmons1WcRnc5fDM52rJ6t%2FWJ7n%2FxxNtqbRLgT27uuQROU2I2ImYFjYIZOkYfhrzVdnePWzsxnby%2FvwjHF3e72ycvWtwr61Z8rpa%2FU%2F%2BrQP5yVzYDXR6mBAdw%3D%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&_opnslfp=1&
Connection: keep-alive
Cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47; isframesetenabled=1

                                         
                                         208.91.196.145
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Tue, 04 Oct 2022 01:13:32 GMT
Server: Apache
Referrer-Policy: no-referrer-when-downgrade
Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
Last-Modified: Wed, 20 Jan 2021 10:45:10 GMT
ETag: "15a-5b952a63b81f1"
Accept-Ranges: bytes
Content-Length: 346
Keep-Alive: timeout=5, max=123
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (346), with no line terminators
Size:   346
Md5:    f84f931c0dd37448e03f0dabf4e4ca9f
Sha1:   9c2c50edcf576453ccc07bf65668bd23c76e8663
Sha256: 5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET /__media__/js/min.js?v2.3 HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Last-Modified: Fri, 08 Apr 2022 08:19:51 GMT
ETag: "624ff027-20f3"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: public, max-age=54201
Expires: Tue, 04 Oct 2022 16:16:53 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Content-Length: 3050
Connection: keep-alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (8349), with CRLF line terminators
Size:   3050
Md5:    683b827c961eb1a55ae52a5c42524a13
Sha1:   a1c0b96af389b99124cb42f1730d2dcb0f3dc3f4
Sha256: 58e12a35c892e412e904c69e12d13915c07afb320633925f41a493ebfc2ee053
                                        
                                            GET /?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZcCmydjcqnBcAL0PeB8S9EhNRxT8H7qsJVpd8YVmJ6fBIEyQj%2Fpqmc5eGBAGG7pixLB8vpcxLVsprTT1E3L5pjSxju%2BWJUgu94oxvOyn3Kt8nty%2F%2BxeKecmons1WcRnc5fDM52rJ6t%2FWJ7n%2FxxNtqbRLgT27uuQROU2I2ImYFjYIZOkYfhrzVdnePWzsxnby%2FvwjHF3e72ycvWtwr61Z8rpa%2FU%2F%2BrQP5yVzYDXR6mBAdw%3D%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&_opnslfp=1& HTTP/1.1 
Host: ww1.lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/
Cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47; isframesetenabled=1
Upgrade-Insecure-Requests: 1

                                         
                                         208.91.196.145
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Date: Tue, 04 Oct 2022 01:13:30 GMT
Server: Apache
Referrer-Policy: no-referrer-when-downgrade
Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_laGJB+nmwAptgH66JudEv7H9xQ8lsu5rSdpfYsfd76XnbH+k4DAytObWIIFkx0ko5tqS4zXNxAJwsUm9FEfetQ==
Keep-Alive: timeout=5, max=125
Connection: Keep-Alive
Cache-Control: private
Content-Encoding: gzip
Transfer-Encoding: chunked


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3896), with CRLF, LF line terminators
Size:   9769
Md5:    92f3d49e4364d626e20ebe1493c3425a
Sha1:   ed7ebcb5c0734a019fed04d21f2cf65f05e1a17a
Sha256: 61384bb26926a874ff7be50c02bc38c863338cdb76a8d61a2561f598eeb59e1b

Alerts:
  Blocklists:
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET /px.js?ch=2 HTTP/1.1 
Host: ww1.lysyfyj.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZcCmydjcqnBcAL0PeB8S9EhNRxT8H7qsJVpd8YVmJ6fBIEyQj%2Fpqmc5eGBAGG7pixLB8vpcxLVsprTT1E3L5pjSxju%2BWJUgu94oxvOyn3Kt8nty%2F%2BxeKecmons1WcRnc5fDM52rJ6t%2FWJ7n%2FxxNtqbRLgT27uuQROU2I2ImYFjYIZOkYfhrzVdnePWzsxnby%2FvwjHF3e72ycvWtwr61Z8rpa%2FU%2F%2BrQP5yVzYDXR6mBAdw%3D%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&_opnslfp=1&
Connection: keep-alive
Cookie: sid=c160115a-4381-11ed-b30c-d566d90cfc47; isframesetenabled=1

                                         
                                         208.91.196.145
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Tue, 04 Oct 2022 01:13:32 GMT
Server: Apache
Referrer-Policy: no-referrer-when-downgrade
Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
Permissions-Policy: ch-ua-platform-version=(self https://dts.gnpge.com), ch-ua-model=(self https://dts.gnpge.com)
Last-Modified: Wed, 20 Jan 2021 10:45:10 GMT
ETag: "15a-5b952a63b81f1"
Accept-Ranges: bytes
Content-Length: 346
Keep-Alive: timeout=5, max=123
Connection: Keep-Alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (346), with no line terminators
Size:   346
Md5:    f84f931c0dd37448e03f0dabf4e4ca9f
Sha1:   9c2c50edcf576453ccc07bf65668bd23c76e8663
Sha256: 5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

Alerts:
  Blocklists:
    - fortinet: Malware
    - mnemonic_dns: Sinkholed
    - quad9: Sinkholed
                                        
                                            GET /__media__/pics/12471/bodybg.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 97189
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-17ba5"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 1637 x 921, 8-bit/color RGB, non-interlaced\012- data
Size:   97189
Md5:    5082ce2ca4166a85ac3651bc34ec3ec8
Sha1:   5069950a6df2fcc07a2318a8459e282f93e45fae
Sha256: e5c767653898a8e9acb1e966aca9d01f39a45609557d1a4811ad26cd48234a1f
                                        
                                            GET /__media__/pics/12471/logo.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 3956
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-f74"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 52 x 60, 8-bit/color RGBA, non-interlaced\012- data
Size:   3956
Md5:    9c98595145e8a8f5a7b6d4f88dceea6a
Sha1:   ee14b50f3332d03e4557c14449deec1fa13ba773
Sha256: b690a0cc0ad3a4899a5e6c52e4a5c7ca6c2f334f946c72b2aafecb316d83b932
                                        
                                            GET /__media__/pics/12471/search-icon.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 1189
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-4a5"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced\012- data
Size:   1189
Md5:    750928ec52c1b77aa2e72d76895d3a96
Sha1:   69465013bc2d4766abfc566eeb2fb5b21ef20e8f
Sha256: cf2e997ed10db7eef3394c65ec68720fce20c858bf202a8c83328b7c1586d87d
                                        
                                            GET /__media__/pics/12471/kwbg.jpg HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/jpeg
                                        
Server: nginx
Content-Length: 37219
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-9163"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 960x574, components 3\012- data
Size:   37219
Md5:    ac32f78c89e9e21e66009a46e538e8ca
Sha1:   6f28ca89ed5e69650c93b230579d774ef586f273
Sha256: f38235e9eeeef5f8b2e931c53a950b8afa0691a4f8bdd32fc79708318cee71fc
                                        
                                            GET /__media__/pics/12471/libg.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 1092
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-444"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 41 x 5, 8-bit/color RGB, non-interlaced\012- data
Size:   1092
Md5:    b06cc0ee3c9be723861a2fe8f3b594e6
Sha1:   4382bf913ea359024f00f6d95f93154bec2b7475
Sha256: 3d876c43f21d31d03eef6d5b51e9cf7d28f6b0f017239300980af88522a173a0
                                        
                                            GET /__media__/pics/12471/arrow.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 1060
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-424"
Accept-Ranges: bytes
Cache-Control: public, max-age=19891
Expires: Tue, 04 Oct 2022 06:45:03 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 12 x 19, 8-bit/color RGBA, non-interlaced\012- data
Size:   1060
Md5:    9b3b30bf536e8e02958b60fe30988cd3
Sha1:   1614df649e959b231e3f33efbd33a69c0ac1b814
Sha256: 368c4a249c5eeb012917122f5314af8f89e7a7cc583d8bef33950f60cf0214d0
                                        
                                            GET /__media__/fonts/ubuntu-r/ubuntu-r.woff HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://ww1.lysyfyj.com
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: application/font-woff
                                        
Server: nginx
Content-Length: 37152
Last-Modified: Wed, 20 Jan 2021 10:45:11 GMT
ETag: "600809b7-9120"
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 37152, version 1.0\012- data
Size:   37152
Md5:    ab6a4224e23ff1a6f0011da5807ff728
Sha1:   7fcb6a535150e2d16f83aad0a92fc48660212b97
Sha256: 9bcf8c298e71f590ac9180df7724c3ff5fe9d84766a5103cf783178639cfcd29
                                        
                                            GET /__media__/fonts/ubuntu-b/ubuntu-b.woff HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://ww1.lysyfyj.com
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: application/font-woff
                                        
Server: nginx
Content-Length: 37928
Last-Modified: Wed, 20 Jan 2021 10:45:11 GMT
ETag: "600809b7-9428"
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  Web Open Font Format, TrueType, length 37928, version 1.0\012- data
Size:   37928
Md5:    eaba38ce39b5e77c6a2f6d4c2d4f9cdb
Sha1:   343a50542a64043963234b3fd17b815b8bcfcbd5
Sha256: 0869d8fe5cfd1878d7cd657cf0b0e9f76f788f3800671d4e36672b271135a5ee
                                        
                                            GET /__media__/pics/12471/libgh.png HTTP/1.1 
Host: i1.cdn-image.com
                                        
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://ww1.lysyfyj.com/

                                         
                                         23.36.76.113
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx
Content-Length: 1081
Last-Modified: Wed, 20 Jan 2021 10:46:07 GMT
ETag: "600809ef-439"
Accept-Ranges: bytes
Cache-Control: public, max-age=21831
Expires: Tue, 04 Oct 2022 07:17:23 GMT
Date: Tue, 04 Oct 2022 01:13:32 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  PNG image data, 41 x 5, 8-bit/color RGB, non-interlaced\012- data
Size:   1081
Md5:    f7b06b634b1d6a88ef2b4308eec1825b
Sha1:   d465b3fb71919eba724173fbd07d17ed61a79791
Sha256: b2a2e95373594e8886a28794ea4b448563391ba6871c79e530cd5c76d86bd4fb