Report - successwin.life/?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo

Report Overview

Visited public
2023-10-26 12:35:17
Tags
URL
successwin.life/?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo
Finishing URL
2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
IP / ASN
185.155.184.72
#6898 SERVER.swiss Sagl
Title
Apple iPhone 14 Pro

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
successwin.life	unknown	2023-10-04	2023-10-04 21:09:28	2023-10-23 17:13:43	523 B	35 kB	185.155.184.72
2635.cuefoottrip.live	unknown	unknown	No data	No data	17 kB	307 kB	185.155.184.152
cdn.jsdelivr.net	439	2012-05-16	2012-09-30 02:15:09	2023-10-25 18:12:39	450 B	24 kB	151.101.1.229
ocsp.pki.goog	175	2016-06-13	2018-07-01 08:43:07	2023-10-25 18:12:06	1.3 kB	2.8 kB	142.250.74.131
ajax.googleapis.com	12905	2005-01-25	2013-08-16 11:51:31	2023-10-25 19:35:04	438 B	32 kB	142.250.74.42
fonts.gstatic.com	unknown	2008-02-11	2014-09-09 02:40:21	2023-10-25 18:52:09	539 B	10 kB	216.58.207.227
jsontdsexit2.com	unknown	2022-05-16	2022-05-16 23:19:05	2023-10-25 20:43:19	463 B	750 B	136.243.216.235

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-10-26 12:35:00	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .life TLD
2023-10-26 12:35:00	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .life TLD
2023-10-26 12:35:00	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .life TLD
2023-10-26 12:35:00	medium	Client IP	Internal IP	ET INFO Observed DNS Query to .life TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-10-26	medium	successwin.life	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed
2023-10-26	medium	cuefoottrip.live	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	From	Size	First Seen	Last Seen
	2635.cuefoottrip.live/media/mainstream/u.js	ScriptElement	25 kB	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/media/mainstream/u.js IP 185.155.184.79 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2085 Hash e44aa4ca20702394c8ca04144c3e9e74 b3734a4cde021bb14d2d296c0ae5dfa8112376f6 e075018e9a06d85a147b1f0d79e8e777da51019b4f306076f8fbba751d42d566 Loading...

	2635.cuefoottrip.live/media/mainstream/all/ab/no/2.js	ScriptElement	416 B	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/media/mainstream/all/ab/no/2.js IP 185.155.184.79 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2389 Hash 9075531370b86e49402928b23fc26c0e b88fc53cd5ef41285a5c1be4b1aecc1a54a7ce0e 31e764b82e550f1e27b814ac8047f8832da32e4a3d7045043f8de1e312112ca3 Loading...

	2635.cuefoottrip.live/media/mainstream/icon.js	ScriptElement	6.6 kB	2023-03-07	2025-02-27
Pretty URL 2635.cuefoottrip.live/media/mainstream/icon.js IP 185.155.184.79 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-02-27 22:24 Times Seen2525 Hash a8e36248f01478844f0c4db185e945a0 d822225c2e21cd5fd7910f825da1e646b21dc078 9195437b3d4ffd3d3652df03d4de4ff03c454386ec19a1777da588a2f83827c2 Loading...

	2635.cuefoottrip.live/media/mainstream/sound.js	ScriptElement	5.0 kB	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/media/mainstream/sound.js IP 185.155.184.79 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2509 Hash 1f1fed792da20aa1e75213d3f1839a0d b5744653854dc322effae7e83ba3b99f8818dffc 32cde492155502743e1b7c5ec41ba974216be8c331db01e5cd933726443241df Loading...

	2635.cuefoottrip.live/media/mainstream/all/ab/2008_1.js	ScriptElement	15 kB	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/media/mainstream/all/ab/2008_1.js IP 185.155.184.152 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2402 Hash 70a301508a891eb3c9f0e7d43cbd2072 37b7e329763c1285514bac3d77808a1a3389b6da e86620b8e47101a2701a71369c8f40d6ac250beeea5a86b69fd407035b57b549 Loading...

	2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D	ScriptElement	580 B	2024-08-21	2024-08-21
Pretty URL 2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D IP 185.155.184.152 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML true Observations First Seen2024-08-21 03:18 Last Seen2024-08-21 03:18 Times Seen1 Hash 78498bbf5fb3a8110351636103ebe73e 86cfa1ce5b317bbab53f55c39ca1c81fc9869348 d491be69817bd001bec9d28f615dcffbd18ff6a99e6ecc3e0a93eaa7ffb4bcf2 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js	ScriptElement	90 kB	2023-03-07	2025-04-30
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 142.250.74.42 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-04-30 01:55 Times Seen107054 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js	ScriptElement	79 kB	2023-03-07	2025-04-29
Pretty URL cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js IP 151.101.1.229 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-04-29 10:39 Times Seen5168 Hash a454220fc07088bf1fdd19313b6bfd50 265a733cb7fbc481fd2510a659a85ad55c93c895 7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c Loading...

	2635.cuefoottrip.live/media/mainstream/all/ab/2008_3.js	ScriptElement	7.5 kB	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/media/mainstream/all/ab/2008_3.js IP 185.155.184.79 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2401 Hash f235f98748487db96795fd73ed48a46d 4cf6f3d733184af759d2f6d2251321df778accdd 5ee7e3f6c675569417eabed4df39057a60e056b0a5eb5abbecf0c1979780d684 Loading...

	2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D	ScriptElement	159 B	2023-03-07	2024-08-21
Pretty URL 2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D IP 185.155.184.152 ASN #6898 SERVER.swiss Sagl Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:02 Last Seen2024-08-21 09:44 Times Seen2551 Hash 9a1faa7af595fcc37df537d166e60db8 685f77872d79510459078c4874685ab2fa7134ad b22f15ea1331a585549a4f1663ad5767da13c94abf77d4a4785158ddabfbd92e Loading...

HTTP Transactions (38)

URL IP Response Size

successwin.life/?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo

185.155.184.72

200 OK

34 kB

URL User Request GET HTTP/1.1
successwin.life/?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo
IP
185.155.184.72:443
ASN
#6898 SERVER.swiss Sagl

Certificate
IssuerLet's Encrypt
Subjectsuccesswin.life
Fingerprint86:20:71:7A:1F:46:31:79:BF:AC:68:82:77:1A:6A:53:29:B7:34:63
ValidityTue, 10 Oct 2023 09:18:31 GMT - Mon, 08 Jan 2024 09:18:30 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (17519), with CRLF line terminators
Size
34 kB (34262 bytes)
Hash
2ebeb345300029c2b1e894527b95e8fc
12599da97213875c895f723eea55bb6b8b02e2f9
f8a63b0aaf66b666f335866715a4b0deb6d5b1ee5cffc69c4e2322f8da313e86

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo HTTP/1.1
Host: successwin.life
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 26 Oct 2023 12:34:59 GMT
Content-Type: text/html
Content-Length: 34262
Connection: keep-alive
set-cookie: sid=t9~faqpazaphlsyqjtbmnx2yoz5; path=/
sid=t9~faqpazaphlsyqjtbmnx2yoz5; path=/
p1=https://cuefoottrip.live/lkxiyefp/; path=/
s1=czqs2rq6defrilun; path=/
cache-control: private, no-transform

2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D

185.155.184.152

200 OK

21 kB

URL User Request GET HTTP/1.1
2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (841), with CRLF line terminators
Size
21 kB (21361 bytes)
Hash
125079eb90e113d9269342c1511fb72b
7a783d2339660fa8699d0c03eb78270973990369
73257c912b0c62f9040b3d4ee7d5788b09c15e8fba34fecb28f9132b03e8c058

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://successwin.life/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: text/html
Content-Length: 21361
Connection: keep-alive
cache-control: private

2635.cuefoottrip.live/media/mainstream/all/ab/2008_2.css

185.155.184.152

200 OK

8.0 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/2008_2.css
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
assembler source, ASCII text
Size
8.0 kB (7969 bytes)
Hash
3a3692009050605115ce92e15cdc4f8a
80f2be7713fc6b704492a24646632ac5b86d610d
24af2f8d21f9612e2b3012382c362743db495fa91370d0f87d22b077caf484af

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/2008_2.css HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: text/css
Content-Length: 7969
Connection: keep-alive
ETag: "3a3692009050605115ce92e15cdc4f8a"
Last-Modified: Wed, 20 Sep 2023 15:23:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A81995D42184
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#284024580/gid:0/gname:root/mode:33188/mtime:1661094568#999105000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T15:09:28.999105Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js

151.101.1.229

200 OK

24 kB

URL GET HTTP/2
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js
IP
151.101.1.229:443
ASN
#54113 FASTLY

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint05:87:2C:BA:73:14:21:54:82:00:8B:AD:85:8F:E9:C6:4D:C7:66:09
ValidityWed, 27 Sep 2023 18:13:13 GMT - Mon, 28 Oct 2024 18:13:12 GMT

File type
ASCII text, with very long lines (65297)
Size
24 kB (23541 bytes)
Hash
a454220fc07088bf1fdd19313b6bfd50
265a733cb7fbc481fd2510a659a85ad55c93c895
7f3145c87d3570154f633975e8a4f8d30aa38603edaba145501e9c90ddbe186c

HTTP Headers

GET /npm/bootstrap@4.3.1/dist/js/bootstrap.bundle.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 4.3.1
x-jsd-version-type: version
etag: W/"1332b-JlpzPLf7xIH9JRCmWaha1VyTyJU"
content-encoding: br
accept-ranges: bytes
date: Thu, 26 Oct 2023 12:35:00 GMT
age: 11006483
x-served-by: cache-fra-eddf8230062-FRA, cache-bma1665-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 23541
X-Firefox-Spdy: h2

2635.cuefoottrip.live/media/mainstream/all/ab/2008.css

185.155.184.152

200 OK

22 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/2008.css
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with CRLF line terminators
Size
22 kB (21546 bytes)
Hash
a008e2dbe07922242a5f012ccd7da015
1b0718855d0c5ca6e25d4553e312c8652df334a7
903a8f67a7fa0613988fa1ab30073aac45e856b60c7b1eace94a95b70db41e42

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/2008.css HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: text/css
Content-Length: 21546
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a008e2dbe07922242a5f012ccd7da015"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A81994EC2D23
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679404829#156295932/gid:0/gname:root/mode:33188/mtime:1661084880#124572000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T12:28:00.124572Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
a7e6dc84285a2e7d15aa8afde0751d4b
5392c576e5f3980abcb99892c53a37585cecd57b
9107b66eafd000a5042343b6179e579c317a8deb6aba714b351a0f138eb7167c

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Oct 2023 12:35:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

2635.cuefoottrip.live/media/mainstream/all/ab/2008_1.js

185.155.184.152

200 OK

15 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/2008_1.js
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with very long lines (927), with CRLF line terminators
Size
15 kB (14759 bytes)
Hash
70a301508a891eb3c9f0e7d43cbd2072
37b7e329763c1285514bac3d77808a1a3389b6da
e86620b8e47101a2701a71369c8f40d6ac250beeea5a86b69fd407035b57b549

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/2008_1.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 14759
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "70a301508a891eb3c9f0e7d43cbd2072"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A819B6928108
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679402415#668622988/gid:0/gname:root/mode:33188/mtime:1661082594#618119000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T11:49:54.618119Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/flag-icon/css/flag-icon.css

185.155.184.152

200 OK

40 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/flag-icon/css/flag-icon.css
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with CRLF line terminators
Size
40 kB (39806 bytes)
Hash
b7a46a018dcd21a4828bae0b04ddcc6c
1d8418d6cc45e5c29e1aab008c18ea633e7730c4
299595fd56aa6a2fcfac34fcf780d33b61785ad96f19485e65a33ead8fd69cbc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/flag-icon/css/flag-icon.css HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: text/css
Content-Length: 39806
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "b7a46a018dcd21a4828bae0b04ddcc6c"
Last-Modified: Mon, 20 Feb 2023 09:33:58 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A819A3BFC8B9
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843396#99757504/gid:0/gname:root/mode:33279/mtime:1655387459#318598233/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:59.318598233Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/2008_3.js

185.155.184.79

200 OK

7.5 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/2008_3.js
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text
Size
7.5 kB (7481 bytes)
Hash
f235f98748487db96795fd73ed48a46d
4cf6f3d733184af759d2f6d2251321df778accdd
5ee7e3f6c675569417eabed4df39057a60e056b0a5eb5abbecf0c1979780d684

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/2008_3.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 7481
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f235f98748487db96795fd73ed48a46d"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6C9CE8BEE23
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676810017#673891798/gid:0/gname:root/mode:33188/mtime:1661082623#6152000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-08-21T11:50:23.006152Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/icon.js

185.155.184.79

200 OK

6.6 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/icon.js
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with very long lines (6570), with no line terminators
Size
6.6 kB (6570 bytes)
Hash
a8e36248f01478844f0c4db185e945a0
d822225c2e21cd5fd7910f825da1e646b21dc078
9195437b3d4ffd3d3652df03d4de4ff03c454386ec19a1777da588a2f83827c2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/icon.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 6570
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a8e36248f01478844f0c4db185e945a0"
Last-Modified: Mon, 03 Apr 2023 12:31:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6C9E58388A1
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349305#423363716/gid:0/gname:root/mode:33279/mtime:1655387452#842583333/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.842583333Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/sound.js

185.155.184.79

200 OK

5.0 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/sound.js
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with very long lines (5014), with no line terminators
Size
5.0 kB (5014 bytes)
Hash
1f1fed792da20aa1e75213d3f1839a0d
b5744653854dc322effae7e83ba3b99f8818dffc
32cde492155502743e1b7c5ec41ba974216be8c331db01e5cd933726443241df

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/sound.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 5014
Connection: keep-alive
ETag: "1f1fed792da20aa1e75213d3f1839a0d"
Last-Modified: Wed, 20 Sep 2023 15:25:15 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A6C9EAD9FB65
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#348024780/gid:0/gname:root/mode:33279/mtime:1655387452#846583343/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.846583343Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

142.250.74.42

200 OK

31 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
142.250.74.42:443
ASN
#15169 GOOGLE

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint28:23:2B:8B:2D:09:6C:BB:06:7A:35:80:95:BB:F8:03:41:C8:99:2C
ValidityThu, 28 Sep 2023 05:32:05 GMT - Thu, 21 Dec 2023 05:32:04 GMT

File type
ASCII text, with very long lines (65451)
Size
31 kB (31021 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 31021
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 23 Oct 2023 10:57:55 GMT
expires: Tue, 22 Oct 2024 10:57:55 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 265025
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

2635.cuefoottrip.live/media/mainstream/all/ab/no/2.js

185.155.184.79

200 OK

416 B

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/no/2.js
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
Unicode text, UTF-8 text, with CRLF line terminators
Size
416 B (416 bytes)
Hash
9075531370b86e49402928b23fc26c0e
b88fc53cd5ef41285a5c1be4b1aecc1a54a7ce0e
31e764b82e550f1e27b814ac8047f8832da32e4a3d7045043f8de1e312112ca3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/no/2.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 416
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "9075531370b86e49402928b23fc26c0e"
Last-Modified: Mon, 03 Apr 2023 12:30:20 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A86865B22137
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349243#411264826/gid:0/gname:root/mode:33279/mtime:1653412332#133070000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:12.13307Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/u.js

185.155.184.79

200 OK

25 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/u.js
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
ASCII text, with very long lines (25177), with no line terminators
Size
25 kB (25177 bytes)
Hash
e44aa4ca20702394c8ca04144c3e9e74
b3734a4cde021bb14d2d296c0ae5dfa8112376f6
e075018e9a06d85a147b1f0d79e8e777da51019b4f306076f8fbba751d42d566

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/u.js HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: application/javascript
Content-Length: 25177
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "e44aa4ca20702394c8ca04144c3e9e74"
Last-Modified: Mon, 20 Feb 2023 09:35:32 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6C62182C766
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676848788#311374889/gid:0/gname:root/mode:33188/mtime:1657924117#384361000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-07-15T22:28:37.384361Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr11.jpg

185.155.184.152

200 OK

3.2 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr11.jpg
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
3.2 kB (3157 bytes)
Hash
752f51c4c387c0ca7f4337acdeec15d6
7f9777f95aececfce6fa930181269cce30a4a059
227cec10c842ba3865d12ed22363f87ca5135b3ac2c72e5ab1a3169c4a2d569c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr11.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 3157
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "752f51c4c387c0ca7f4337acdeec15d6"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A8409277B077
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349274#687314584/gid:0/gname:root/mode:33279/mtime:1653412324#445053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.445053Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/x1.png

185.155.184.79

200 OK

593 B

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/x1.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Size
593 B (593 bytes)
Hash
ee850988ed56cd6f2498cae7993a8753
965f9091ca3e7f21f5b8115347227aedc93c586e
0303153a716bc5000d737521c0f6eb517700a1856b8e22ba8c088ec8f06ed8ba

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/x1.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 593
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "ee850988ed56cd6f2498cae7993a8753"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6C7057BBA3E
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#855577336/gid:0/gname:root/mode:33279/mtime:1653412336#881081000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:16.881081Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/top_red.png

185.155.184.79

200 OK

4.6 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/top_red.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Size
4.6 kB (4560 bytes)
Hash
a660370feb6a1543c3c872a52f7bcfa7
b9478ed6228e8fb34a393013d474cde8dc400848
9d1eed749548dad4b80b2d7ce32052143bd38773685029d7b60cee82a31840b7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/top_red.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 4560
Connection: keep-alive
ETag: "a660370feb6a1543c3c872a52f7bcfa7"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A6C7021A8A8C
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#276024555/gid:0/gname:root/mode:33279/mtime:1653412335#773078000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:15.773078Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/box_open.png

185.155.184.79

200 OK

2.7 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/box_open.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 258 x 185, 8-bit colormap, non-interlaced\012- data
Size
2.7 kB (2685 bytes)
Hash
99264bee31a1abde5d0035468e53bbfb
d1f25383b68c3769eb3bdb36783e85c112078054
8da9180789c861b8d0d67d2bca168dfcc6de98f6999ab47400c38397d122157f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box_open.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 2685
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "99264bee31a1abde5d0035468e53bbfb"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6CA28F2DB5F
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349274#687314584/gid:0/gname:root/mode:33279/mtime:1653412322#933050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.93305Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/like.png

185.155.184.79

200 OK

357 B

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/like.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 15 x 14, 8-bit colormap, non-interlaced\012- data
Size
357 B (357 bytes)
Hash
17586a0aeb3f7b2aa7fb15a9251fbcd4
6adffad1183c93bc0dc114c89c77365734ec0dd6
8bf8dc3a4b6f7e4fa2a6fa74495c212f37a301311980cbc758050993ed9c07e1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/like.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 357
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "17586a0aeb3f7b2aa7fb15a9251fbcd4"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6D09AFE7ECA
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412329#505064000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:09.505064Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
a7e6dc84285a2e7d15aa8afde0751d4b
5392c576e5f3980abcb99892c53a37585cecd57b
9107b66eafd000a5042343b6179e579c317a8deb6aba714b351a0f138eb7167c

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Oct 2023 12:35:00 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

2635.cuefoottrip.live/media/mainstream/all/ab/box_closed.png

185.155.184.152

200 OK

5.8 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/box_closed.png
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 258 x 184, 8-bit colormap, non-interlaced\012- data
Size
5.8 kB (5836 bytes)
Hash
890d869db1b3d28af588be81685214f2
5375bd0c2c75a6e40168f5561eb4eca993d14505
ea2521add13deb769fb7abee364670a567e7a3dc7b3b4474b5f80510dc593212

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box_closed.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 5836
Connection: keep-alive
ETag: "890d869db1b3d28af588be81685214f2"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A819EE734CF9
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412322#873050000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:02.87305Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/iphone14pro.png

185.155.184.79

200 OK

37 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/iphone14pro.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 440 x 514, 8-bit colormap, non-interlaced\012- data
Size
37 kB (37189 bytes)
Hash
2f6bfed27c86fb5b0cf0796e73089fb0
be5c1a83cb372816542e8f92e75fddcc12872d42
601790639edd8b031101566f42f5ca7bb57d1fd090aff2783f7a5f5a1ceb0084

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/iphone14pro.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 37189
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "2f6bfed27c86fb5b0cf0796e73089fb0"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6C701CDB4A6
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679402022#535984516/gid:0/gname:root/mode:33188/mtime:1663242360#392676000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-09-15T11:46:00.392676Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr6.jpg

185.155.184.79

200 OK

2.8 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr6.jpg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
2.8 kB (2814 bytes)
Hash
f17d127dfcaa6f94929eedd080276df0
ec801473523b8eb44e123b5634081d2b57715ba6
0108e4d428f408f819f174ae8a5923b4010e80a14fc9872b018c12781e114403

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr6.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 2814
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f17d127dfcaa6f94929eedd080276df0"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6D108AECE74
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#765054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.765054Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/box-iphone14pro.png

185.155.184.79

200 OK

4.5 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/box-iphone14pro.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 258 x 185, 8-bit colormap, non-interlaced\012- data
Size
4.5 kB (4457 bytes)
Hash
e26ab4191e2b939c553ea223042be270
1ef6e06777ad700e46a5d5995573b8ad09d339c8
7cc901bcb50159c267c3ecd4995bb69dbd47939ca52c81ab28f527651200e472

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/box-iphone14pro.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 4457
Connection: keep-alive
ETag: "e26ab4191e2b939c553ea223042be270"
Last-Modified: Wed, 20 Sep 2023 15:23:21 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A6CA299CBA37
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#284024580/gid:0/gname:root/mode:33188/mtime:1667333084#863076000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-11-01T20:04:44.863076Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr2.jpg

185.155.184.79

200 OK

2.8 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr2.jpg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
2.8 kB (2815 bytes)
Hash
9b63ccbd631923743813e838190cecbf
5c6dd930c81346616e9c641ff41b6f18344c7e76
4ca9130a03f6874bab37d2d52fd4546e3de34ccccbd83aa5b9cb6ed0f923d8b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr2.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 2815
Connection: keep-alive
ETag: "9b63ccbd631923743813e838190cecbf"
Last-Modified: Wed, 20 Sep 2023 15:23:22 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A6CA3E747AC9
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134509#272024543/gid:0/gname:root/mode:33279/mtime:1653412324#505053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.505053Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr3.jpg

185.155.184.79

200 OK

3.6 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr3.jpg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
3.6 kB (3601 bytes)
Hash
c74a5befd416e24626972e88ed65526d
4e8c25553248600cf23c3d6bcec488d986a129f8
53bb570f4465306a78670ecbea911ba0362251d2dc825d9ea0cb5d1c70f413ac

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr3.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 3601
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "c74a5befd416e24626972e88ed65526d"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6D0DD38AFA3
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349274#687314584/gid:0/gname:root/mode:33279/mtime:1653412324#581053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.581053Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr1.jpg

185.155.184.152

200 OK

2.9 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr1.jpg
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
2.9 kB (2939 bytes)
Hash
4c88ebf87b0cc26121497de03db7f64a
a1256a5cfcd62223172eb3633659caddff6cf005
28db5edb0fe5e61f42eb8a0d10250a317f3ac840e074ffa761cb953c330f2cf6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr1.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 2939
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "4c88ebf87b0cc26121497de03db7f64a"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A8408F9A3748
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#385053000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.385053Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/l.png

185.155.184.79

200 OK

9.2 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/l.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 768 x 293, 8-bit colormap, non-interlaced\012- data
Size
9.2 kB (9224 bytes)
Hash
a0560779cf67aeb9a0c19f68f3582024
ff8d079fbbbad6b70be4d83c760a4a61bc51ff33
b585ee5fc0af431c584664f82e390e5a65bbbc6f201fe495d7c289ea618f5d5e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/l.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 9224
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "a0560779cf67aeb9a0c19f68f3582024"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6CA1022D5B8
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679404098#535214755/gid:0/gname:root/mode:33188/mtime:1675688264#107993000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2023-02-06T12:57:44.107993Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr4.jpg

185.155.184.79

200 OK

4.3 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr4.jpg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
4.3 kB (4307 bytes)
Hash
f96150cbbb80ac607b3f264141a7faef
9ed21cb4e5c552f29bc23db55684c945e7582071
f013c5f2d9aedd8072d4bf01749c7dfcbacb80a43d06aa579403adfd8fd21fd3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr4.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 4307
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "f96150cbbb80ac607b3f264141a7faef"
Last-Modified: Mon, 20 Feb 2023 09:33:01 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6CA41E8A9DA
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676843277#847577324/gid:0/gname:root/mode:33279/mtime:1653412324#641054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.641054Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/fr5.jpg

185.155.184.79

200 OK

3.0 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/fr5.jpg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3\012- data
Size
3.0 kB (3043 bytes)
Hash
7f103bc91a8084cd154189b5ebb2cf86
375e58c42a8c409bbf111847a1f6798ba6c0d5f5
346139aaec984853288672896d297ded47ac7ee1cb77ca43b63e130952cdd946

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/fr5.jpg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/jpeg
Content-Length: 3043
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "7f103bc91a8084cd154189b5ebb2cf86"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A6CA3FD59FB1
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349274#687314584/gid:0/gname:root/mode:33279/mtime:1653412324#705054000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-05-24T17:12:04.705054Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/media/mainstream/all/ab/muti_iphone14pro.png

185.155.184.79

200 OK

39 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/all/ab/muti_iphone14pro.png
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
PNG image data, 500 x 375, 8-bit colormap, non-interlaced\012- data
Size
39 kB (38744 bytes)
Hash
42735146d56c0e4289363b6286186f9d
8d9cfa2d7653ac990e7b4df29550e8f3fbb0ff6d
b96b3a8a526eeadaf754a2b9239fe520179c9ee48cdf07da8b6b2d136066681b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/all/ab/muti_iphone14pro.png HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:00 GMT
Content-Type: image/png
Content-Length: 38744
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "42735146d56c0e4289363b6286186f9d"
Last-Modified: Mon, 20 Feb 2023 09:33:02 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Request-Id: 1791A6C6DF63EAB8
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1676849985#960972255/gid:0/gname:root/mode:33188/mtime:1663542090#630579000/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-09-18T23:01:30.630579Z
Expires: Fri, 25 Oct 2024 12:35:00 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
cf24af84f2ef501aec7ab5241cd90cd6
4e1c1e7c028c195d9658f7ce45713f8530315aee
c59a67efbe5d50a13fbcd53e087c886f9bf0f6be5df8ce7c504089442b7433df

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Oct 2023 12:35:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

216.58.207.227

200 OK

9.1 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint55:7F:79:64:ED:7A:04:50:63:54:9C:32:2A:AF:B7:95:17:D7:E0:33
ValidityThu, 28 Sep 2023 05:32:05 GMT - Thu, 21 Dec 2023 05:32:04 GMT

File type
Web Open Font Format (Version 2), TrueType, length 9132, version 1.0\012- data
Size
9.1 kB (9132 bytes)
Hash
358d3070946a90b4960cd111154fdc12
a0ba0bf47a7f905f9aa1a3ce15a39cdac62466ee
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

HTTP Headers

GET /s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://2635.cuefoottrip.live
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9132
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 21 Oct 2023 01:21:23 GMT
expires: Sun, 20 Oct 2024 01:21:23 GMT
cache-control: public, max-age=31536000
age: 472418
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
cf24af84f2ef501aec7ab5241cd90cd6
4e1c1e7c028c195d9658f7ce45713f8530315aee
c59a67efbe5d50a13fbcd53e087c886f9bf0f6be5df8ce7c504089442b7433df

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 26 Oct 2023 12:35:01 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

2635.cuefoottrip.live/media/mainstream/alert.mp3

185.155.184.152

200 OK

8.8 kB

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/alert.mp3
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Monaural\012- data
Size
8.8 kB (8802 bytes)
Hash
6d2d3da2ea28ace816fa4a138829dc18
606e0ec3d7fb05c69f16233cfe1ff0a0ee760505
d79bc81189750262716692ade6cc4d6fb6c4fbc4aa01c2b9d0aa67e5788821fc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/alert.mp3 HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Cookie: cookie1=true
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:01 GMT
Content-Type: audio/mpeg
Content-Length: 8802
Connection: keep-alive
Content-Security-Policy: block-all-mixed-content
ETag: "6d2d3da2ea28ace816fa4a138829dc18"
Last-Modified: Mon, 03 Apr 2023 12:30:19 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Request-Id: 1791A81A216ABFDC
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1679349305#423363716/gid:0/gname:root/mode:33279/mtime:1655387452#802583242/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:50:52.802583242Z
Expires: Fri, 25 Oct 2024 12:35:01 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

2635.cuefoottrip.live/favicon.ico

185.155.184.152

204 No Content

0 B

URL GET HTTP/1.1
2635.cuefoottrip.live/favicon.ico
IP
185.155.184.152:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Cookie: cookie1=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Server: openresty
Date: Thu, 26 Oct 2023 12:35:01 GMT
Connection: keep-alive

2635.cuefoottrip.live/media/mainstream/flag-icon/flags/1x1/no.svg

185.155.184.79

200 OK

331 B

URL GET HTTP/1.1
2635.cuefoottrip.live/media/mainstream/flag-icon/flags/1x1/no.svg
IP
185.155.184.79:443
ASN
#6898 SERVER.swiss Sagl

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectcuefoottrip.live
Fingerprint97:A5:81:8B:1B:AA:0A:4E:70:47:F8:A4:99:B4:4F:C8:6D:46:CA:06
ValidityTue, 17 Oct 2023 19:23:55 GMT - Mon, 15 Jan 2024 19:23:54 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with CRLF line terminators
Size
331 B (331 bytes)
Hash
d748f0d9f64c0ca1a40a0f6ec6bbb746
a76adb95e9ea9a737c72e4640b8d49b9e28cbb38
bdfbd626e4e76d0dc506e10be7dd429e4c4da684986cbd45e5398f1e9e1f28cc

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /media/mainstream/flag-icon/flags/1x1/no.svg HTTP/1.1
Host: 2635.cuefoottrip.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/media/mainstream/flag-icon/css/flag-icon.css
Cookie: cookie1=true
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: openresty
Date: Thu, 26 Oct 2023 12:35:01 GMT
Content-Type: image/svg+xml
Content-Length: 331
Connection: keep-alive
ETag: "d748f0d9f64c0ca1a40a0f6ec6bbb746"
Last-Modified: Wed, 20 Sep 2023 15:24:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Origin, Accept-Encoding
X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
X-Amz-Request-Id: 1791A8689057CDFE
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
x-amz-meta-mc-attrs: atime:1693134508#296021489/gid:0/gname:root/mode:33279/mtime:1655387477#774640726/uid:0/uname:root
x-amz-meta-mm-source-mtime: 2022-06-16T13:51:17.774640726Z
Expires: Fri, 25 Oct 2024 12:35:01 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes

jsontdsexit2.com/ExtService.svc/getextparams

136.243.216.235

200 OK

535 B

URL GET HTTP/2
jsontdsexit2.com/ExtService.svc/getextparams
IP
136.243.216.235:443
ASN
#24940 Hetzner Online GmbH

Requested by
https://2635.cuefoottrip.live/lkxiyefp/article2635.doc?u=7mkpd0d&o=ex5whk5&t=p9udbp8vLTl70LyHYmxjX0HEUyXo&f=1&sid=t9~faqpazaphlsyqjtbmnx2yoz5&fp=G3atwxiFqQHx7PBsUNLMUg%3D%3D
Certificate
IssuerLet's Encrypt
Subjectjsontdsexit2.com
FingerprintFB:58:BF:8B:39:B9:7C:7C:B6:D3:3F:78:F4:91:D1:A0:08:4D:AB:50
ValidityThu, 21 Sep 2023 09:46:23 GMT - Wed, 20 Dec 2023 09:46:22 GMT

File type
troff or preprocessor input, Unicode text, UTF-8 text, with very long lines (626), with no line terminators
Size
535 B (535 bytes)
Hash
9b69d953721186e3b4aef94ae0f06573
f8518d29cdd7e44ff4795ed9e17bb3d492284db9
2d5bc0411de26154bbf28bd94c0508c46e504195699206d539256e05d1b92e03

HTTP Headers

GET /ExtService.svc/getextparams HTTP/1.1
Host: jsontdsexit2.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://2635.cuefoottrip.live
DNT: 1
Connection: keep-alive
Referer: https://2635.cuefoottrip.live/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Thu, 26 Oct 2023 12:35:01 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
content-encoding: gzip
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by