| code.jquery.com/jquery-3.7.0.min.js | 151.101.2.137 | 200 OK | 30 kB |
URL GET HTTP/2code.jquery.com/jquery-3.7.0.min.js IP151.101.2.137:443
Requested byhttps://rare-uploader.com/winloader/ CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hashe6c2415c0ace414e5153670314ce99a9 5a9eeac34d86e92e5660e0f4f87204f1ed0c8ff6 d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
GET /jquery-3.7.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://rare-uploader.com
DNT: 1
Connection: keep-alive
Referer: https://rare-uploader.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-155a6"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 10 May 2024 08:48:34 GMT
age: 1187143
x-served-by: cache-lga13623-LGA, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 6, 177327
x-timer: S1715330914.006663,VS0,VE0
vary: Accept-Encoding
content-length: 30308
X-Firefox-Spdy: h2
|
|
| rare-uploader.com/winloader/ | 172.67.190.53 | 200 OK | 46 kB |
URL User Request GET HTTP/2rare-uploader.com/winloader/ IP172.67.190.53:443
CertificateIssuerGoogle Trust Services LLC Subjectrare-uploader.com Fingerprint84:8E:20:71:F8:8D:01:8C:13:FE:78:2E:39:71:13:DE:AF:8C:AD:F7 ValidityWed, 08 May 2024 05:22:11 GMT - Tue, 06 Aug 2024 05:22:10 GMT
File typeHTML document, ASCII text, with very long lines (59830) Hash64510f810d6de997d06e033ba354b8a6 6b1c77bd33ab910fe6aaa11a6d8efea09979eaea 7c2a9a72b91f4e7573d4cee0748960bff3cac42c5c809093ddfeb3f88dff2098
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /winloader/ HTTP/1.1
Host: rare-uploader.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 10 May 2024 08:48:33 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FPd%2F%2B%2BYzs5G2q7X3EVVmTtVFC%2Booe5XALZRCyIw5Q0dLLs1dCYAPXYmo%2BOg3kF5Fqh%2FiymZQjOid1%2BuyNAsQXzv2fknvpYtpbavtiYHpeWgXml1bspIVX6nB5ciRNrsGDgjyqA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8818abc24d405693-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| win-officeload.com/load10.php?a1=https://kmsauto.org/download/windows-loader-by-daz.zip/&b1=windows-loader-by-daz.zip | 172.67.174.251 | 301 Moved Permanently | 64 kB |
URL User Request GET HTTP/2win-officeload.com/load10.php?a1=https://kmsauto.org/download/windows-loader-by-daz.zip/&b1=windows-loader-by-daz.zip IP172.67.174.251:443
CertificateIssuerGoogle Trust Services LLC Subjectwin-officeload.com Fingerprint89:33:35:CB:9A:FC:F2:5E:6E:36:F5:14:07:DA:6A:94:E3:31:72:6A ValiditySun, 05 May 2024 21:31:25 GMT - Sat, 03 Aug 2024 21:31:24 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /load10.php?a1=https://kmsauto.org/download/windows-loader-by-daz.zip/&b1=windows-loader-by-daz.zip HTTP/1.1
Host: win-officeload.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Fri, 10 May 2024 08:48:33 GMT
content-type: text/html; charset=UTF-8
location: https://rare-uploader.com/winloader/
strict-transport-security: max-age=31536000
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P28yNLgTsGfY0feO3ZK2AIEQAV7Y4oLEFJOEeUWjXYkGnLvZwLMSIvuknDzTtpdP%2BK6ZEpAJSA91lyARe0V%2FOLS5H%2FJ8nOqWPWguIazPidBZ31%2FD%2F2aIsOT43qPTbzYZbjznVJ0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8818abbf9df50b31-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| rare-uploader.com/track.js | 172.67.190.53 | 200 OK | 542 B |
URL GET HTTP/3rare-uploader.com/track.js IP172.67.190.53:443
Requested byhttps://rare-uploader.com/winloader/ CertificateIssuerGoogle Trust Services LLC Subjectrare-uploader.com Fingerprint84:8E:20:71:F8:8D:01:8C:13:FE:78:2E:39:71:13:DE:AF:8C:AD:F7 ValidityWed, 08 May 2024 05:22:11 GMT - Tue, 06 Aug 2024 05:22:10 GMT
File typeJavaScript source, ASCII text, with very long lines (566), with no line terminators Hashdc9d22beb8bf82708e0c89000080a81f f1f168f1c709b91631832624a20cb0743ea46a29 8a592ab823c1f9f895c7b8b276fddd0ad0b4c20a8ea376c744a6585c9b23eab8
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /track.js HTTP/1.1
Host: rare-uploader.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rare-uploader.com/winloader/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 10 May 2024 08:48:33 GMT
content-type: application/javascript
last-modified: Sat, 17 Feb 2024 14:05:56 GMT
etag: W/"65d0bd44-21e"
expires: Fri, 10 May 2024 19:09:16 GMT
cache-control: max-age=86400
content-encoding: gzip
cf-cache-status: HIT
age: 49157
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DVIOp%2FlAHcyqizBIxxkvL1tFZlpdmTDf5nZqbOKvw12M50ahtMmPDcqH1A%2FY1Uto5dlYjYPHwM6M%2B8ziWAmiUmY9Yu2HwbC6qMDsD4hE1Dd7ZWO%2Fg%2Fi5U7%2F%2FBDOE9jD1nnbu%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8818abc40b77569a-OSL
alt-svc: h3=":443"; ma=86400
|
|
| mtmoweb.website/matomo.js | 212.162.153.43 | 200 OK | 67 kB |
URL GET HTTP/1.1mtmoweb.website/matomo.js IP212.162.153.43:443
Requested byhttps://rare-uploader.com/winloader/ CertificateIssuerLet's Encrypt Subjectmtmoweb.website Fingerprint1F:99:13:67:F3:AF:CD:D6:E9:02:90:E7:CD:9D:A5:C9:3B:DD:16:86 ValiditySun, 07 Apr 2024 06:41:24 GMT - Sat, 06 Jul 2024 06:41:23 GMT
File typeJavaScript source, ASCII text, with very long lines (1601) Hash14cdc4216e8570c05349164d12516056 51bd805b6a84d245aaa345bcc7d221c43780bd3b b39abd9035f703b76dfed940898d572b9864f676eb1912a9142f0639dca6b2ce
GET /matomo.js HTTP/1.1
Host: mtmoweb.website
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rare-uploader.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 10 May 2024 08:48:34 GMT
Content-Type: application/javascript
Last-Modified: Sun, 07 Apr 2024 10:03:56 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"66126f8c-1042f"
Expires: Sat, 11 May 2024 08:48:34 GMT
Cache-Control: max-age=86400
Content-Encoding: gzip
|
|
| rare-uploader.com/favicon.ico | 172.67.190.53 | 404 Not Found | 209 B |
URL GET HTTP/3rare-uploader.com/favicon.ico IP172.67.190.53:443
Requested byhttps://rare-uploader.com/winloader/ CertificateIssuerGoogle Trust Services LLC Subjectrare-uploader.com Fingerprint84:8E:20:71:F8:8D:01:8C:13:FE:78:2E:39:71:13:DE:AF:8C:AD:F7 ValidityWed, 08 May 2024 05:22:11 GMT - Tue, 06 Aug 2024 05:22:10 GMT
File typeHTML document, ASCII text, with no line terminators Hash8ace35f18ab1832bacfde13597767517 22e4ee51bbdba11b19a2d6879bc60126dc89eecd f87134d32dc903f27ed9c905bfd824f31192dac9e05887b2dedbb1ca416d1280
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: rare-uploader.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rare-uploader.com/winloader/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 10 May 2024 08:48:34 GMT
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OByofigpyi2cQ6yPN65vKzktI9FzBErcTJCnBfsEsSGtTqc1TSnXm3flfgoSAfTYWJfWmLwkWEsPwKIdjhDaq0pbOBw6agzIZfqBwvbWDtCPNrrRmb5znLn9KNFhVqyChZpinA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8818abc8ec94569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|