| r11.o.lencr.org/ |  23.36.77.32 | | 504 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hasha081f9755218e081db962afea1117844 fab4e95becdbacea971038e8f0ea80b4e1064e4b db03b08d76424bb0dd34b51c11cf222b9126bd1f6017afd35cb1c2d0c3d1f86e
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DB03B08D76424BB0DD34B51C11CF222B9126BD1F6017AFD35CB1C2D0C3D1F86E"
Last-Modified: Fri, 23 Aug 2024 14:33:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15927
Expires: Sat, 24 Aug 2024 18:23:17 GMT
Date: Sat, 24 Aug 2024 13:57:50 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash0116304cb4b20e1766015ee4e636662f c2b93f53852c06a7a9648a817818c0d5a7011898 8d8503dca377a8430cd883acdec16a62201f61ff923847bb95cd00b4b5b76dee
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "8D8503DCA377A8430CD883ACDEC16A62201F61FF923847BB95CD00B4B5B76DEE"
Last-Modified: Fri, 23 Aug 2024 14:36:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12657
Expires: Sat, 24 Aug 2024 17:28:47 GMT
Date: Sat, 24 Aug 2024 13:57:50 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hash515f455d93caad6521481d99fc23e623 cb770c44b3e280f2151b3f5e887d61fbe0ef66fb cf43d0127c72bf58a1799b4e7ce0e5c9e18ec12e978df6dac9c17920a20173d5
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "CF43D0127C72BF58A1799B4E7CE0E5C9E18EC12E978DF6DAC9C17920A20173D5"
Last-Modified: Fri, 23 Aug 2024 14:37:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12769
Expires: Sat, 24 Aug 2024 17:30:39 GMT
Date: Sat, 24 Aug 2024 13:57:50 GMT
Connection: keep-alive
|
|
| r10.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashf04a331cae60388b5b3c547bcdd5a8e8 a74ba9ea1965e39a78db26c6568b3524156f0b5c 133a1fe03de9efd148f43efda3cd37d24e4f5cc936d1008a8ce7aacc6653afa3
POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "133A1FE03DE9EFD148F43EFDA3CD37D24E4F5CC936D1008A8CE7AACC6653AFA3"
Last-Modified: Fri, 23 Aug 2024 14:38:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13907
Expires: Sat, 24 Aug 2024 17:49:37 GMT
Date: Sat, 24 Aug 2024 13:57:50 GMT
Connection: keep-alive
|
|
| GET bfcmtrtrw.shop/wp-includes/blocks/navigation/style.min.css?ver=6.6.1 |  66.29.146.64 | 200 OK | 2.1 kB |
URL GET HTTP/2bfcmtrtrw.shop/wp-includes/blocks/navigation/style.min.css?ver=6.6.1 IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeASCII text, with very long lines (16384), with no line terminators Hash248b1933d8fafcd0e9927fba349545c9 da66b61dcc5204277eb7846b9dce55b2e7d58a42 837b6cb608d918fcd1361fb556d54f0a80d0dd10172790698504b2054535589e
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/blocks/navigation/style.min.css?ver=6.6.1 HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Sat, 31 Aug 2024 13:57:51 GMT
content-type: text/css
last-modified: Tue, 23 Jul 2024 22:54:27 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 2069
date: Sat, 24 Aug 2024 13:57:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| GET bfcmtrtrw.shop/wp-includes/blocks/navigation/view.min.js?ver=6.6.1 | 66.29.146.64 | 200 OK | 1.0 kB |
URL GET HTTP/2bfcmtrtrw.shop/wp-includes/blocks/navigation/view.min.js?ver=6.6.1 IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeASCII text, with very long lines (3300), with no line terminators Hash1dd354b759c9108102c93d8bae0573a1 b27ba805d3b9118edfd523f01fd6e84229d52ffd cef72ad53596109595c152da16e28c2799d53b4c151274c7b28c0324e7230f24
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/blocks/navigation/view.min.js?ver=6.6.1 HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
last-modified: Tue, 09 Apr 2024 22:23:45 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 1026
date: Sat, 24 Aug 2024 13:57:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| GET bfcmtrtrw.shop/wp-includes/js/dist/interactivity.min.js?ver=6.6.1 | 66.29.146.64 | 200 OK | 13 kB |
URL GET HTTP/2bfcmtrtrw.shop/wp-includes/js/dist/interactivity.min.js?ver=6.6.1 IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (36651) Hasha2610b49e606e402d0e0e656044342ee 39f2fd1115fdb171ea318c2ca240c7fe53df79b4 429fc71a17fa7f185fd18f6c0c082c4840a6c616cfcaa6869d6ab11c90b3a178
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/dist/interactivity.min.js?ver=6.6.1 HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/wp-includes/blocks/navigation/view.min.js?ver=6.6.1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/javascript
last-modified: Tue, 16 Jul 2024 23:00:53 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 13210
date: Sat, 24 Aug 2024 13:57:52 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| GET bfcmtrtrw.shop/favicon.ico | 66.29.146.64 | 404 Not Found | 1.3 kB |
URL GET HTTP/2bfcmtrtrw.shop/favicon.ico IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeHTML document, ASCII text, with CRLF, LF line terminators Hash8150f458ed6fb9b1db4e5cfa57a1a281 6e5726854d28687b560d7fdcb5c782c425c7dfb9 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
content-type: text/html
content-length: 1251
date: Sat, 24 Aug 2024 13:57:52 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| | 66.29.146.64 | 200 OK | 23 kB |
URL User Request GET HTTP/2IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (16341) Hash0fc5e912a8eeccadffb3c133a2e24552 b3d041248dd5596277efd3aa03f2cf52cd07884d 2a7be7b9b70543246ef9b4aa4b7f40826e8651d159b91fa666cd9ddc231b82ca
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
link: <https://bfcmtrtrw.shop/wp-json/>; rel="https://api.w.org/"
etag: "36194-1724507500;br"
x-litespeed-cache: hit
content-encoding: br
vary: Accept-Encoding
date: Sat, 24 Aug 2024 13:57:51 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| r11.o.lencr.org/ | 23.36.76.226 | | 504 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashf3a7d4b907a16e7e82883be9ff3cc7a4 cb041fb7a99151a86d3449564d72737a53edefba b9187d8fcc431cee0496985416a1d32f8b4f32f7f454230e012a80db9bd4de1e
POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B9187D8FCC431CEE0496985416A1D32F8B4F32F7F454230E012A80DB9BD4DE1E"
Last-Modified: Fri, 23 Aug 2024 14:34:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5478
Expires: Sat, 24 Aug 2024 15:29:10 GMT
Date: Sat, 24 Aug 2024 13:57:52 GMT
Connection: keep-alive
|
|
| GET bfcmtrtrw.shop/page/2/ | 66.29.146.64 | 200 OK | 18 kB |
IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (16341) Hash08e523bdd10bbf2cf5d54f273de82d50 1bfde5771c11d206b17aec0c17fd8a59fd4693fc 54aa313fe8b05b2967cce236852d75af24ec8a076f056244d778e2fa2aa1fb15
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /page/2/ HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
link: <https://bfcmtrtrw.shop/wp-json/>; rel="https://api.w.org/"
etag: "36197-1724507873;br"
x-litespeed-cache: miss
content-length: 18150
content-encoding: br
vary: Accept-Encoding
date: Sat, 24 Aug 2024 13:57:53 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| GET bfcmtrtrw.shop/wp-includes/js/wp-emoji-release.min.js?ver=6.6.1 | 66.29.146.64 | 200 OK | 19 kB |
URL GET HTTP/2bfcmtrtrw.shop/wp-includes/js/wp-emoji-release.min.js?ver=6.6.1 IP66.29.146.64:443
CertificateIssuerSectigo Limited Subjectbfcmtrtrw.shop FingerprintAF:58:0E:A9:EB:75:74:5A:A0:AF:BD:E5:96:4D:0D:C1:A2:8A:37:B4 ValidityMon, 11 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (15752) Hashb976b651932bfd25b9ddb5b7693d88a7 7fcb7cb5c11227f9213b1e08a07d0212209e1432 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /wp-includes/js/wp-emoji-release.min.js?ver=6.6.1 HTTP/1.1
Host: bfcmtrtrw.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://bfcmtrtrw.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/javascript
last-modified: Tue, 02 Apr 2024 22:49:15 GMT
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 4676
date: Sat, 24 Aug 2024 13:57:52 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|